Lucene search

LenovoVULNRICHMENT:CVE-2023-25493

HistoryApr 05, 2024 - 8:46 p.m.

CVE-2023-25493

2024-04-0520:46:00

CWE-306

lenovo

github.com

bios update

driver vulnerability

desktop products

smart edge

smart office

thinkstation

local user

elevated privileges

arbitrary code

CVSS3

6.7

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation

none

Automatable

Technical Impact

total

JSON

A potential vulnerability was reported in the BIOS update tool driver for some Desktop, Smart Edge, Smart Office, and ThinkStation products that could allow a local user with elevated privileges to execute arbitrary code.

ADP Affected

[
  {
    "cpes": [
      "cpe:2.3:o:lenovo:bios:-:*:*:*:*:*:*:*"
    ],
    "vendor": "lenovo",
    "product": "bios",
    "versions": [
      {
        "status": "affected",
        "version": "0"
      }
    ],
    "defaultStatus": "unknown"
  }
]

References

support.lenovo.com/us/en/product_security/LEN-141775

CVSS3

6.7

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation

none

Automatable

Technical Impact

total

JSON

Related for VULNRICHMENT:CVE-2023-25493