Potential Vulnerability in BIOS of Desktop Products Could Allow Local Attack with Elevated Privileges

CVE-2023-25494

6.7MEDIUM

Key Information

Vendor: Lenovo
Status: Desktop BiOS, Smart Edge BiOS, Thinkstation BiOS
Vendor: CVE Published:; 5 April 2024

Summary

A potential vulnerability were reported in the BIOS of some Desktop, Smart Edge, and ThinkStation products that could allow a local attacker with elevated privileges to write to NVRAM variables.

Affected Version(s)

Desktop BIOS, Smart Edge BIOS, ThinkStation BIOS = various

CVSS V3.1

Score:

6.7

Severity:

MEDIUM

Confidentiality:

High

Integrity:

High

Availability:

High

Attack Vector:

Local

Attack Complexity:

Low

Privileges Required:

High

User Interaction:

None

Scope:

Unchanged

Timeline

Risk change from: null to: 6.7 - (MEDIUM)
Jun 20, 2024
Vulnerability published.
Apr 5, 2024

Collectors

NVD DatabaseMitre Database

Credit

Lenovo thanks Souhardya Sardar of Cyberstanc for reporting this issue.