DeutschShown in its original language — a full translation is planned for a future version.
Lenovo BIOS: Mehrere Schwachstellen
view advisory published 2023-11-08
Ein lokaler Angreifer kann mehrere Schwachstellen im Lenovo BIOS ausnutzen, um beliebigen Programmcode mit Administratorrechten auszuführen, beliebigen Programmcode auszuführen, Dateien zu manipulieren oder Informationen offenzulegen.
01
describes (26)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2023-25494US | — | — | ||
A potential vulnerability were reported in the BIOS of some Desktop, Smart Edge, and ThinkStation products that could allow a local attacker with elevated privileges to write to N… | ||||
| CVE-2023-25493US | —OT elevated | — | ||
A potential vulnerability was reported in the BIOS update tool driver for some Desktop, Smart Edge, Smart Office, and ThinkStation products that could allow a local user with eleva… | ||||
| CVE-2023-45079US | medium6.7 | — | ||
A memory leakage vulnerability was reported in the NvmramSmm SMM driver that may allow a local attacker with elevated privileges to write to NVRAM variables.
| ||||
| CVE-2023-45078US | medium6.7 | — | ||
A memory leakage vulnerability was reported in the DustFilterAlertSmm SMM driver that may allow a local attacker with elevated privileges to write to NVRAM variables. | ||||
| CVE-2023-45077US | medium6.7 | — | ||
A memory leakage vulnerability was reported in the 534D0740 DXE driver that may allow a local attacker with elevated privileges to write to NVRAM variables. | ||||
| CVE-2023-45076US | medium6.7 | — | ||
A memory leakage vulnerability was reported in the 534D0140 DXE driver that may allow a local attacker with elevated privileges to write to NVRAM variables.
| ||||
| CVE-2023-45075US | medium6.7 | — | ||
A memory leakage vulnerability was reported in the SWSMI_Shadow DXE driver that may allow a local attacker with elevated privileges to write to NVRAM variables. | ||||
| CVE-2023-43581US | medium6.7 | — | ||
A buffer overflow was reported in the Update_WMI module in some Lenovo Desktop products that may allow a local attacker with elevated privileges to execute arbitrary code. | ||||
| CVE-2023-43580US | medium6.7 | — | ||
A buffer overflow was reported in the SmuV11DxeVMR module in some Lenovo Desktop products that may allow a local attacker with elevated privileges to execute arbitrary code. | ||||
| CVE-2023-43579US | medium6.7 | — | ||
A buffer overflow was reported in the SmuV11Dxe driver in some Lenovo Desktop products that may allow a local attacker with elevated privileges to execute arbitrary code. | ||||
| CVE-2023-43578US | medium6.7 | — | ||
A buffer overflow was reported in the SmiFlash module in some Lenovo Desktop products that may allow a local attacker with elevated privileges to execute arbitrary code. | ||||
| CVE-2023-43577US | medium6.7 | — | ||
A buffer overflow was reported in the ReFlash module in some Lenovo Desktop products that may allow a local attacker with elevated privileges to execute arbitrary code. | ||||
| CVE-2023-43576US | medium6.7 | — | ||
A buffer overflow was reported in the WMISwSmi module in some Lenovo Desktop products that may allow a local attacker with elevated privileges to execute arbitrary code. | ||||
| CVE-2023-43575US | medium6.7 | — | ||
A buffer overflow was reported in the UltraFunctionTable module in some Lenovo Desktop products that may allow a local attacker with elevated privileges to execute arbitrary code. | ||||
| CVE-2023-43574US | medium4.4 | — | ||
A buffer over-read was reported in the LEMALLDriversConnectedEventHook module in some Lenovo Desktop products that may allow a local attacker with elevated privileges
to disclose… | ||||
| CVE-2023-43573US | medium6.7 | — | ||
A buffer overflow was reported in the LEMALLDriversConnectedEventHook module in some Lenovo Desktop products that may allow a local attacker with elevated privileges to execute arb… | ||||
| CVE-2023-43572US | medium4.4 | — | ||
A buffer over-read was reported in the BiosExtensionLoader module in some Lenovo Desktop products that may allow a local attacker with elevated privileges to disclose sensitive inf… | ||||
| CVE-2023-43571US | medium6.7 | — | ||
A buffer overflow was reported in the BiosExtensionLoader module in some Lenovo Desktop products that may allow a local attacker with elevated privileges to execute arbitrary code. | ||||
| CVE-2023-5078US | medium6.7 | — | ||
A vulnerability was reported in some ThinkPad BIOS that could allow a physical or local attacker with elevated privileges to tamper with BIOS firmware. | ||||
| CVE-2023-5075US | medium6.7 | — | ||
A buffer overflow was reported in the FmpSipoCapsuleDriver driver in the IdeaPad Duet 3-10IGL5 that may allow a local attacker with elevated privileges to execute arbitrary code. | ||||
showing 20 of 26
02
references
External citations — patches, advisories, analysis.
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan