CVE-2016-8222
A vulnerability has been identified in a signed kernel driver for the BIOS of some ThinkPad...
A vulnerability has been identified in a signed kernel driver for the BIOS of some ThinkPad systems that can allow an attacker with Windows administrator-level privileges to call System Management Mode (SMM) services. This could lead to a denial of service attack or allow certain BIOS variables or settings to be altered (such as boot sequence). The setting or changing of BIOS passwords is not affected by this vulnerability.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- High
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
A vulnerability has been identified in a signed kernel driver for the BIOS of some ThinkPad systems that can allow an attacker with Windows administrator-level privileges to call System Management Mode (SMM) services. This could lead to a denial of service attack or allow certain BIOS variables or settings to be altered (such as boot sequence). The setting or changing of BIOS passwords is not affected by this vulnerability.
- Record
CVE-2016-8222- CVSS 3.0
- 4.4 Medium
CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H - CVSS 2.0
- 4.7 Medium
AV:L/AC:M/Au:N/C:N/I:N/A:C - Weakness
- CWE-284
- Updated
- 2026-11-02
CVE List No score
A vulnerability has been identified in a signed kernel driver for the BIOS of some ThinkPad systems that can allow an attacker with Windows administrator-level privileges to call System Management Mode (SMM) services. This could lead to a denial of service attack or allow certain BIOS variables or settings to be altered (such as boot sequence). The setting or changing of BIOS passwords is not affected by this vulnerability.
- Record
CVE-2016-8222- Updated
- 2026-11-02
EUVDEUVD-2016-9070 No score
A vulnerability has been identified in a signed kernel driver for the BIOS of some ThinkPad systems that can allow an attacker with Windows administrator-level privileges to call System Management Mode (SMM) services. This could lead to a denial of service attack or allow certain BIOS variables or settings to be altered (such as boot sequence). The setting or changing of BIOS passwords is not affected by this vulnerability.
- Record
EUVD-2016-9070- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-7jpm-3pp4-32q5
A vulnerability has been identified in a signed kernel driver for the BIOS of some ThinkPad...
A vulnerability has been identified in a signed kernel driver for the BIOS of some ThinkPad systems that can allow an attacker with Windows administrator-level privileges to call System Management Mode (SMM) services. This could lead to a denial of service attack or allow certain BIOS variables or settings to be altered (such as boot sequence). The setting or changing of BIOS passwords is not affected by this vulnerability.
- Record
GHSA-7jpm-3pp4-32q5- CVSS 3.0
- 4.4 Medium
CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-284
- Updated
- 2026-11-02
Affected products
- lenovo group ltd. thinkpad systems
- lenovo thinkpad 10 ella 2 bios
- lenovo thinkpad 11e beema bios
- lenovo thinkpad 11e braswell bios
- lenovo thinkpad 11e broadwell bios
- lenovo thinkpad 11e skylake bios
- lenovo thinkpad 13e bios
- lenovo thinkpad e450 bios
- lenovo thinkpad e450c bios
- lenovo thinkpad e455 bios
- lenovo thinkpad e460 bios
- lenovo thinkpad e465 bios
Show 63 moreShow less
- lenovo thinkpad e550 bios
- lenovo thinkpad e550c bios
- lenovo thinkpad e555 bios
- lenovo thinkpad e560 bios
- lenovo thinkpad e565 bios
- lenovo thinkpad edge e440 bios
- lenovo thinkpad edge e445 bios
- lenovo thinkpad edge e540 bios
- lenovo thinkpad edge e545 bios
- lenovo thinkpad helix 20cg bios
- lenovo thinkpad helix 20ch bios
- lenovo thinkpad l440 bios
- lenovo thinkpad l450 bios
- lenovo thinkpad l460 bios
- lenovo thinkpad l540 bios
- lenovo thinkpad l560 bios
- lenovo thinkpad p50 bios
- lenovo thinkpad p50s bios
- lenovo thinkpad p70 bios
- lenovo thinkpad s1 yoga 12 bios
- lenovo thinkpad s1 yoga non vpro bios
- lenovo thinkpad s1 yoga vpro bios
- lenovo thinkpad s3 s440 bios
- lenovo thinkpad s3 yoga 14 bios
- lenovo thinkpad s540 bios
- lenovo thinkpad s5 e560p bios
- lenovo thinkpad s5 yoga 15 bios
- lenovo thinkpad t440 bios
- lenovo thinkpad t440p bios
- lenovo thinkpad t440s bios
- lenovo thinkpad t440u bios
- lenovo thinkpad t450 bios
- lenovo thinkpad t450s bios
- lenovo thinkpad t460 bios
- lenovo thinkpad t460p bios
- lenovo thinkpad t460s bios
- lenovo thinkpad t540 bios
- lenovo thinkpad t540p bios
- lenovo thinkpad t550 bios
- lenovo thinkpad t560 bios
- lenovo thinkpad tablet 10 bios
- lenovo thinkpad tablet 8 bios
- lenovo thinkpad w540 bios
- lenovo thinkpad w541 bios
- lenovo thinkpad w550s bios
- lenovo thinkpad x140e amd bios
- lenovo thinkpad x1 carbon 20ax bios
- lenovo thinkpad x1 carbon 20bx bios
- lenovo thinkpad x1 carbon bios
- lenovo thinkpad x1 tablet bios
- lenovo thinkpad x1 yoga bios
- lenovo thinkpad x240 bios
- lenovo thinkpad x240s bios
- lenovo thinkpad x250 broadwell bios
- lenovo thinkpad x250 sharkbay bios
- lenovo thinkpad x260 bios
- lenovo thinkpad yoga 11e beema bios
- lenovo thinkpad yoga 11e bios
- lenovo thinkpad yoga 11e braswell bios
- lenovo thinkpad yoga 11e broadwell bios
- lenovo thinkpad yoga 11e skylake bios
- lenovo thinkpad yoga 14 460 s3 bios
- lenovo thinkpad yoga 260 s1 bios
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2016-8222 is a medium vulnerability (CVSS 4.4) in Lenovo Group Ltd. Thinkpad Systems, published November 30, 2016. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.30%, the 23rd percentile. No source names a fixed version.