CVE-2022-48188 json
A buffer overflow vulnerability in the SecureBootDXE BIOS driver of some Lenovo Desktop and ThinkStation models could allow an attacker wit…
published 2023-06-05 3 y ago modified 2026-06-17 4 mo ago also EUVD-2022-50899
- cvss
- 6.7
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.2%
- EPSS 0.2% chance of exploitation in 30 days, percentile 8%
- public exploits
- 0
- none known
Summary
A buffer overflow vulnerability in the SecureBootDXE BIOS driver of some Lenovo Desktop and ThinkStation models could allow an attacker with local access to elevate their privileges to execute arbitrary code.
Patch / fix
- lenovo ideacentre_aio_3_21itl7_firmware o5akt33
- lenovo ideacentre_aio_3-22itl6_firmware o5akt33
- lenovo ideacentre_aio_3-24itl6_firmware o5akt33
- lenovo ideacentre_aio_3-27itl6_firmware o5akt33
- lenovo thinkcentre_m720e_firmware m1zkt40a
- lenovo thinkcentre_m720q_firmware m1ukt70a
- lenovo thinkcentre_m720s_firmware m1ukt70a
- lenovo thinkcentre_m720t_firmware m1ukt70a
- lenovo thinkcentre_m725s_firmware m25kt63a
- lenovo thinkcentre_m75s_gen_2_firmware m3bkt30a, m46kt30a
- lenovo thinkcentre_m75t_gen_2_firmware m3akt4ca, m46kt30a
- lenovo thinkcentre_m920q_firmware m1ukt70a
- lenovo thinkcentre_m920s_firmware m1ukt70a
- lenovo thinkcentre_m920t_firmware m1ukt70a
- lenovo thinkcentre_m920x_firmware m1ukt70a
- lenovo thinkcentre_m920z_firmware m1mkt55a
- lenovo ideacentre_510s-07icb_firmware m22kt48a, m22kt49a
- lenovo ideacentre_510s-07ick_firmware m1zkt40a, m30kt28a
- lenovo ideacentre_720-18apr_firmware m25kt63a
- lenovo v30a-22itl_firmware o5akt33
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- total
- Assessed
- 22 mo ago
Exploit prediction
0.19% chance of exploitation in the next 30 days, higher than 8% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 6.7 | CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H |
| NVD | 3.1 | 7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Affected products
- Lenovo ThinkStation BIOS
Classification
- Weakness
-
- CWE-787 Out-of-bounds Write
References
-
support.lenovo.com
/us/en/product_security/LEN-124495
vendor-advisory
Sources
- CVE List CVE-2022-48188
- NVD CVE-2022-48188
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.