CVE-2022-4575: Lenovo Thinkpad 25 Firmware

Medium severity, CVSS 6.7. EPSS: 0.2% chance of exploitation in the next 30 days.

A vulnerability due to improper write protection of UEFI variables was reported in the BIOS of some ThinkPad models could allow an attacker with physical or local access and elevated privileges the ability to bypass Secure Boot.

Affected products

• Lenovo Thinkpad 25 Firmware: before 1.73 (fixed in 1.73)
• Lenovo Thinkpad l560 Firmware: before 1.62 (fixed in 1.62)
• Lenovo Thinkpad p50 Firmware: before 1.71 (fixed in 1.71)
• Lenovo Thinkpad p50s Firmware: before 1.45 (fixed in 1.45)
• Lenovo Thinkpad p70 Firmware: before 2.45 (fixed in 2.45)
• Lenovo Thinkpad t470 Firmware: before 1.73 (fixed in 1.73)
• Lenovo Thinkpad t470s Firmware: before 1.49 (fixed in 1.49)
• Lenovo Thinkpad t560 Firmware: before 1.45 (fixed in 1.45)
• Lenovo Thinkpad x1 Carbon 4th Gen Firmware: before 1.56 (fixed in 1.56)
• Lenovo Thinkpad x1 Yoga 1st Gen Firmware: before 1.56 (fixed in 1.56)
• Lenovo Thinkpad x260 Firmware: before 1.50 (fixed in 1.50)
• Lenovo Thinkpad x270 Firmware: before 1.47 (fixed in 1.47)
• Lenovo Thinkpad Yoga 260 Firmware: before 1.88 (fixed in 1.88)

Published 2023-10-30. Last modified 2026-06-17.