Potential Vulnerability in BIOS of Desktop Products Could Allow Local Attack with Elevated Privileges
CVE-2023-25494

6.7MEDIUM

Key Information:

Vendor
Lenovo
Status
Desktop BiOS, Smart Edge BiOS, Thinkstation BiOS
Vendor
CVE Published:
5 April 2024

Summary

A potential vulnerability exists within the BIOS of various Lenovo products, including Desktop, Smart Edge, and ThinkStation models. This issue may enable a local attacker with elevated privileges to write unauthorized changes to NVRAM variables, potentially compromising system configurations and security. Users of the affected products should remain vigilant and apply any available updates to mitigate risks associated with this vulnerability.

Affected Version(s)

Desktop BIOS, Smart Edge BIOS, ThinkStation BIOS various

References

https://support.lenovo.com/us/en/product_security/LEN-141775

CVSS V3.1

Score:
6.7
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

Credit

Lenovo thanks Souhardya Sardar of Cyberstanc for reporting this issue.
.