Lenovo Thinkpad vulnerabilities

7 vulnerabilities

Known vulnerabilities in Lenovo Thinkpad, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

10CVE-2007-1307intelpro_1000_lan_adapter+1
EPSS score
1.62%
Unspecified vulnerability in Lenovo Intel PRO/1000 LAN adapter before Build 135400, as used on IBM Lenovo ThinkPad systems, has unknown impact and attack vectors.2.4CVE-2020-8341lenovothinkpad+10
EPSS score
0.35%
In Lenovo systems, SMM BIOS Write Protection is used to prevent writes to SPI Flash. While this provides sufficient protection, an additional layer of protection is provided by SPI Protected Range Registers (PRx). After resuming from S3 sleep mode in various versions of BIOS for some Lenovo ThinkPad systems, the PRx is not set. This does not impact the SMM BIOS Write Protection, which keeps systems protected.6.4CVE-2019-6170lenovo130-14ikb_firmware+392
EPSS score
0.35%
A potential vulnerability in the SMI callback function used in the Legacy USB driver using boot services structure in runtime phase in some Lenovo ThinkPad models may allow arbitrary code execution.6.4CVE-2019-6172lenovo130-14ikb_firmware+392
EPSS score
0.33%
A potential vulnerability in the SMI callback function used in Legacy USB driver using passed parameter without sufficient checking in some Lenovo ThinkPad models may allow arbitrary code execution.6.7CVE-2023-2290lenovothinkpad+85
EPSS score
0.16%
A potential vulnerability in the LenovoFlashDeviceInterface SMI handler may allow an attacker with local access and elevated privileges to execute arbitrary code.8.4CVE-2023-4030lenovothinkpad+4
EPSS score
0.19%
A vulnerability was reported in BIOS for ThinkPad P14s Gen 2, P15s Gen 2, T14 Gen 2, and T15 Gen 2 that could cause the system to recover to insecure settings if the BIOS becomes corrupt.6.7CVE-2023-4029lenovok14_type_21cu_firmware+26
EPSS score
0.19%
A buffer overflow has been identified in the BoardUpdateAcpiDxe driver in some Lenovo ThinkPad products which may allow an attacker with local access and elevated privileges to execute arbitrary code.