CVE-2022-3431 — Incorrect Default Permissions in Lenovo D330-10igl Firmware

CWE-276 — Incorrect Default PermissionsCWE-2644 documents4 sources
Severity
7.8HIGHNVD
CNA6.7CISA8.8
EPSS
0.0%
top 89.84%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
26
Lenovo D330-10igl FirmwareLenovo Ideapad 5 Pro-16ach6 FirmwareLenovo Ideapad 5 Pro-16ihu6 Firmware+23 more
Timeline
PublishedOct 9

Description

A potential vulnerability in a driver used during manufacturing process on some consumer Lenovo Notebook devices that was mistakenly not deactivated may allow an attacker with elevated privileges to modify secure boot setting by modifying an NVRAM variable.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages26 packages

🔴Vulnerability Details

2
GHSA
GHSA-jgmr-c4c9-rqmx: A potential vulnerability in a driver used during manufacturing process on some consumer Lenovo Notebook devices that was mistakenly not deactivated m↗2023-10-09
▶
CVEList
CVE-2022-3431: A potential vulnerability in a driver used during manufacturing process on some consumer Lenovo Notebook devices that was mistakenly not deactivated m↗2023-10-09
▶

📋Vendor Advisories

1
CISA
Oracle VirtualBox Insufficient Input Validation Vulnerability↗2022-03-03
▶
CVE-2022-3431 — Incorrect Default Permissions in Lenovo | cvebase