Skip to content
Fencer Vulns
medium 6.7

CVE-2022-4575 json

A vulnerability due to improper write protection of UEFI variables was reported in the BIOS of some ThinkPad models could allow an attacker…

published 2023-10-30 3 y ago modified 2026-06-17 4 mo ago also EUVD-2022-51908

cvss
6.7
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.2%
EPSS 0.2% chance of exploitation in 30 days, percentile 7%
public exploits
0
none known

Summary

A vulnerability due to improper write protection of UEFI variables was reported in the BIOS of some ThinkPad models could allow an attacker with physical or local access and elevated privileges the ability to bypass Secure Boot.

Patch / fix

  • lenovo thinkpad_25_firmware 1.73
  • lenovo thinkpad_l560_firmware 1.62
  • lenovo thinkpad_p50_firmware 1.71
  • lenovo thinkpad_p50s_firmware 1.45
  • lenovo thinkpad_p70_firmware 2.45
  • lenovo thinkpad_t470_firmware 1.73
  • lenovo thinkpad_t470s_firmware 1.49
  • lenovo thinkpad_t560_firmware 1.45
  • lenovo thinkpad_x1_carbon_4th_gen_firmware 1.56
  • lenovo thinkpad_x1_yoga_1st_gen_firmware 1.56
  • lenovo thinkpad_x260_firmware 1.50
  • lenovo thinkpad_x270_firmware 1.47
  • lenovo thinkpad_yoga_260_firmware 1.88

Exploit prediction

0.18% chance of exploitation in the next 30 days, higher than 7% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
NVD 3.1 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Affected products

  • Lenovo ThinkPad BIOS

Classification

Weakness
  • CWE-276 Incorrect Default Permissions

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.