CVE-2023-4028: Lenovo 13w Yoga Firmware

Medium severity, CVSS 6.7. EPSS: 0.2% chance of exploitation in the next 30 days.

A buffer overflow has been identified in the SystemUserMasterHddPwdDxe driver in some Lenovo Notebook products which may allow an attacker with local access and elevated privileges to execute arbitrary code.

Affected products

  • Lenovo 13w Yoga Firmware: before jacn38ww (fixed in jacn38ww)
  • Lenovo 13w Yoga Gen 2 Firmware: before kbcn20ww (fixed in kbcn20ww)
  • Lenovo Flex 5-14alc05 Firmware: before gjcn32ww (fixed in gjcn32ww)
  • Lenovo Flex 5-14are05 Firmware: before eecn43ww (fixed in eecn43ww)
  • Lenovo Flex 5-14iil05 Firmware: before eccn45ww (fixed in eccn45ww)
  • Lenovo Flex 5-14itl05 Firmware: before fxcn44ww (fixed in fxcn44ww)
  • Lenovo Flex 5-15alc05 Firmware: before gjcn32ww (fixed in gjcn32ww)
  • Lenovo Flex 5-15iil05 Firmware: before eccn45ww (fixed in eccn45ww)
  • Lenovo Flex 5-15itl05 Firmware: before fxcn44ww (fixed in fxcn44ww)
  • Lenovo Flex 7 14iru8 Firmware: before l6cn20ww (fixed in l6cn20ww)
  • Lenovo Ideapad 1-11ada05 Firmware: before fqcn29ww (fixed in fqcn29ww)
  • Lenovo Ideapad 1-11igl05 Firmware: before dwcn28ww (fixed in dwcn28ww)
  • Lenovo Ideapad 1-14ada05 Firmware: before fqcn29ww (fixed in fqcn29ww)
  • Lenovo Ideapad 1-14igl05 Firmware: before dwcn28ww (fixed in dwcn28ww)
  • Lenovo Ideapad Flex 5 14abr8 Firmware: before l7cn17ww (fixed in l7cn17ww)
  • Lenovo Ideapad Flex 5 14alc7 Firmware: before jccn35ww (fixed in jccn35ww)
  • Lenovo Ideapad Flex 5 14iau7 Firmware: before j7cn44ww (fixed in j7cn44ww)
  • Lenovo Ideapad Flex 5 14iru8 Firmware: before l6cn20ww (fixed in l6cn20ww)
  • Lenovo Ideapad Flex 5 16abr8 Firmware: before l7cn17ww (fixed in l7cn17ww)
  • Lenovo Ideapad Flex 5 16alc7 Firmware: before jccn35ww (fixed in jccn35ww)
  • Lenovo Ideapad Flex 5 16iau7 Firmware: before j7cn44ww (fixed in j7cn44ww)
  • Lenovo Ideapad Flex 5 16iru8 Firmware: before l6cn20ww (fixed in l6cn20ww)
  • Lenovo Thinkbook 13s g2 Are Firmware: before fvcn28ww (fixed in fvcn28ww)
  • Lenovo Thinkbook 13s g2 Itl Firmware: before f9cn57ww (fixed in f9cn57ww)
  • Lenovo Thinkbook 13s g3 Acn Firmware: before gmcn35ww (fixed in gmcn35ww)
  • and 4 more

Published 2023-08-17. Last modified 2026-06-17.