CVE-2022-4575: A vulnerability due to improper write protection of UEFI variables was reported in the BIOS of some ThinkPad models could allow an attacker with physical or…

PriorityP428medium6.7CVSS 3.1

AVLACLPRHUINSUCHIHAH

EPSS

0.18%

7.7th percentile

A vulnerability due to improper write protection of UEFI variables was reported in the BIOS of some ThinkPad models could allow an attacker with physical or local access and elevated privileges the ability to bypass Secure Boot.

Affected

14 ranges

Vendor	Product	Version range	Fixed in
lenovo	thinkpad_25_firmware	< 1.73	1.73
lenovo	thinkpad_bios	—	—
lenovo	thinkpad_l560_firmware	< 1.62	1.62
lenovo	thinkpad_p50_firmware	< 1.71	1.71
lenovo	thinkpad_p50s_firmware	< 1.45	1.45
lenovo	thinkpad_p70_firmware	< 2.45	2.45
lenovo	thinkpad_t470_firmware	< 1.73	1.73
lenovo	thinkpad_t470s_firmware	< 1.49	1.49
lenovo	thinkpad_t560_firmware	< 1.45	1.45
lenovo	thinkpad_x1_carbon_4th_gen_firmware	< 1.56	1.56
lenovo	thinkpad_x1_yoga_1st_gen_firmware	< 1.56	1.56
lenovo	thinkpad_x260_firmware	< 1.50	1.50
lenovo	thinkpad_x270_firmware	< 1.47	1.47
lenovo	thinkpad_yoga_260_firmware	< 1.88	1.88

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.