CVE-2022-48189: Lenovo Thinkpad e14 Firmware

Medium severity, CVSS 6.7. EPSS: 0.2% chance of exploitation in the next 30 days.

An SMM driver input validation vulnerability in the BIOS of some ThinkPad models could allow an attacker with local access and elevated privileges to execute arbitrary code.

Affected products

  • Lenovo Thinkpad e14 Firmware: before 1.23 (fixed in 1.23)
  • Lenovo Thinkpad e14 Gen 2 Firmware: before 1.55 (fixed in 1.55)
  • Lenovo Thinkpad e14 Gen 4 Firmware: before 1.18 (fixed in 1.18); before 1.16 (fixed in 1.16)
  • Lenovo Thinkpad e15 Firmware: before 1.23 (fixed in 1.23)
  • Lenovo Thinkpad e15 Gen 2 Firmware: before 1.55 (fixed in 1.55)
  • Lenovo Thinkpad e15 Gen 4 Firmware: before 1.18 (fixed in 1.18); before 1.16 (fixed in 1.16)
  • Lenovo Thinkpad e490 Firmware: before 1.34 (fixed in 1.34)
  • Lenovo Thinkpad e490s Firmware: before 1.34 (fixed in 1.34)
  • Lenovo Thinkpad e590 Firmware: before 1.34 (fixed in 1.34)
  • Lenovo Thinkpad l13 Gen 3 Firmware: before 1.14 (fixed in 1.14)
  • Lenovo Thinkpad l13 Yoga Gen 3 Firmware: before 1.14 (fixed in 1.14)
  • Lenovo Thinkpad l14 Firmware: before 1.2 (fixed in 1.2); before 1.3 (fixed in 1.3); affected versions not specified; before 1.26 (fixed in 1.26)
  • Lenovo Thinkpad l15 Firmware: before 1.2 (fixed in 1.2); before 1.3 (fixed in 1.3)
  • Lenovo Thinkpad l15 Gen 2 Firmware: affected versions not specified
  • Lenovo Thinkpad l15 Gen 3 Firmware: before 1.26 (fixed in 1.26)
  • Lenovo Thinkpad l490 Firmware: before 1.32 (fixed in 1.32)
  • Lenovo Thinkpad l590 Firmware: before 1.32 (fixed in 1.32)
  • Lenovo Thinkpad p14s Gen 1 Firmware: before 1.28 (fixed in 1.28)
  • Lenovo Thinkpad p14s Gen 2 Firmware: affected versions not specified; before 1.34 (fixed in 1.34)
  • Lenovo Thinkpad p14s Gen 3 Firmware: affected versions not specified
  • Lenovo Thinkpad p15 Gen 1 Firmware: before 1.32 (fixed in 1.32)
  • Lenovo Thinkpad p15 Gen 2 Firmware: before 1.25 (fixed in 1.25)
  • Lenovo Thinkpad p15s Gen 1 Firmware: before 1.28 (fixed in 1.28)
  • Lenovo Thinkpad p15s Gen 2 Firmware: affected versions not specified
  • Lenovo Thinkpad p15v Gen 1 Firmware: before 1.32 (fixed in 1.32)
  • and 60 more

Published 2023-10-30. Last modified 2026-06-17.