Lenovo BIOS vulnerabilities

5 CVEs affecting Lenovo BIOS, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2023-25493, published 2024-04-05.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2016-5247, published 2016-09-22. High severity, CVSS 7.8. EPSS: 0.4% chance of exploitation in the next 30 days. The BIOS for Lenovo ThinkCentre E93, M6500t/s, M6600, M6600q, M6600t/s, M73p, M800, M83, M8500t/s, M8600t/s, M900, M93, and M93P devices; ThinkServer RQ940, RS140, TS140, TS240, TS440, and TS540…
CVE-2017-3754, published 2017-07-17. Medium severity, CVSS 6.7. EPSS: 0.3% chance of exploitation in the next 30 days. Some Lenovo brand notebook systems do not have write protections properly configured in the system BIOS. This could enable an attacker with physical or administrative access to a system to be able to…
CVE-2016-8224, published 2016-11-29. Medium severity, CVSS 4.4. EPSS: 0.3% chance of exploitation in the next 30 days. A vulnerability has been identified in some Lenovo Notebook and ThinkServer systems where an attacker with administrative privileges on a system could install a program that circumvents Intel…
CVE-2021-3452, published 2021-07-16. Medium severity, CVSS 6.7. EPSS: 0.3% chance of exploitation in the next 30 days. A potential vulnerability in the system shutdown SMI callback function in some ThinkPad models may allow an attacker with local access and elevated privileges to execute arbitrary code.
CVE-2023-25493, published 2024-04-05. Medium severity, CVSS 6.7. EPSS: 0.2% chance of exploitation in the next 30 days. A potential vulnerability was reported in the BIOS update tool driver for some Desktop, Smart Edge, Smart Office, and ThinkStation products that could allow a local user with elevated privileges to…