Potential Vulnerability in BIOS of Desktop Products Could Allow Local Attack with Elevated Privileges
CVE-2023-25494

6.7MEDIUM

Key Information:

Vendor

Lenovo
Status
Desktop BiOS, Smart Edge BiOS, Thinkstation BiOS
Vendor
CVE Published:
5 April 2024

What is CVE-2023-25494?

A potential vulnerability exists within the BIOS of various Lenovo products, including Desktop, Smart Edge, and ThinkStation models. This issue may enable a local attacker with elevated privileges to write unauthorized changes to NVRAM variables, potentially compromising system configurations and security. Users of the affected products should remain vigilant and apply any available updates to mitigate risks associated with this vulnerability.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

Desktop BIOS, Smart Edge BIOS, ThinkStation BIOS various

References

https://support.lenovo.com/us/en/product_security/LEN-141775

CVSS V3.1

Score:
6.7
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

Credit

Lenovo thanks Souhardya Sardar of Cyberstanc for reporting this issue.
JSON
.