CVE-2023-2290: Lenovo Thinkpad e14 Firmware

Medium severity, CVSS 6.7. EPSS: 0.2% chance of exploitation in the next 30 days.

A potential vulnerability in the LenovoFlashDeviceInterface SMI handler may allow an attacker with local access and elevated privileges to execute arbitrary code.

Affected products

• Lenovo Thinkpad e14 Firmware: version 1.23 only
• Lenovo Thinkpad e14 Gen 2 Firmware: version 1.55 only
• Lenovo Thinkpad e14 Gen 4 Firmware: version 1.18 only; version 1.16 only
• Lenovo Thinkpad e15 Firmware: version 1.23 only
• Lenovo Thinkpad e15 Gen 2 Firmware: version 1.55 only
• Lenovo Thinkpad e15 Gen 4 Firmware: version 1.18 only; version 1.16 only
• Lenovo Thinkpad e490 Firmware: version 1.34 only
• Lenovo Thinkpad e490s Firmware: version 1.34 only
• Lenovo Thinkpad e590 Firmware: version 1.34 only
• Lenovo Thinkpad l13 Gen 3 Firmware: version 1.14 only
• Lenovo Thinkpad l13 Yoga Gen 3 Firmware: version 1.14 only
• Lenovo Thinkpad l14 Firmware: version 1.2 only; version 1.3 only; version 1.48 only; version 1.61 only; version 1.26 only
• Lenovo Thinkpad l15 Firmware: version 1.2 only; version 1.3 only
• Lenovo Thinkpad l15 Gen 2 Firmware: version 1.48 only; version 1.61 only
• Lenovo Thinkpad l15 Gen 3 Firmware: version 1.26 only
• Lenovo Thinkpad l490 Firmware: version 1.32 only
• Lenovo Thinkpad l590 Firmware: version 1.32 only
• Lenovo Thinkpad p14s Gen 1 Firmware: version 1.28 only
• Lenovo Thinkpad p14s Gen 2 Firmware: version 1.05 only; version 1.55 only; version 1.34 only
• Lenovo Thinkpad p14s Gen 3 Firmware: version 1.11 only; version 1.31 only
• Lenovo Thinkpad p15 Gen 1 Firmware: version 1.32 only
• Lenovo Thinkpad p15 Gen 2 Firmware: version 1.25 only
• Lenovo Thinkpad p15s Gen 1 Firmware: version 1.28 only
• Lenovo Thinkpad p15s Gen 2 Firmware: version 1.05 only; version 1.55 only
• Lenovo Thinkpad p15v Gen 1 Firmware: version 1.32 only
• and 60 more

Published 2023-06-26. Last modified 2026-06-17.