CVE-2022-3430
A potential vulnerability in the WMI Setup driver on some consumer Lenovo Notebook devices may...
A potential vulnerability in the WMI Setup driver on some consumer Lenovo Notebook devices may allow an attacker with elevated privileges to modify secure boot setting by modifying an NVRAM variable.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- High
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
A potential vulnerability in the WMI Setup driver on some consumer Lenovo Notebook devices may allow an attacker with elevated privileges to modify secure boot setting by modifying an NVRAM variable.
- Record
CVE-2022-3430- CVSS 3.1
- 6.7 Medium
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-276
- Updated
- 2026-11-02
EUVDEUVD-2022-42806
A potential vulnerability in the WMI Setup driver on some consumer Lenovo Notebook devices may allow an attacker with elevated privileges to modify secure boot setting by modifying an NVRAM variable.
- Record
EUVD-2022-42806- CVSS 3.1
- 6.7 Medium
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-vj5w-88wc-3p42
A potential vulnerability in the WMI Setup driver on some consumer Lenovo Notebook devices may...
A potential vulnerability in the WMI Setup driver on some consumer Lenovo Notebook devices may allow an attacker with elevated privileges to modify secure boot setting by modifying an NVRAM variable.
- Record
GHSA-vj5w-88wc-3p42- CVSS 3.1
- 6.7 Medium
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-276
- Updated
- 2026-11-02
NVD
A potential vulnerability in the WMI Setup driver on some consumer Lenovo Notebook devices may allow an attacker with elevated privileges to modify secure boot setting by modifying an NVRAM variable.
- Record
CVE-2022-3430- CVSS 3.1
- 6.7 Medium
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-276
- Updated
- 2026-11-02
Affected products
- lenovo bios
- lenovo d330-10igl firmware
- lenovo ideapad 5 pro 16arh7 firmware
- lenovo ideapad 5 pro 16iah7 firmware
- lenovo ideapad duet 3 10igl5 firmware
- lenovo ideapad slim 7-14iil05 firmware
- lenovo ideapad slim 7-14itl05 firmware
- lenovo ideapad slim 7-15iil05 firmware
- lenovo slim 7-14are05 firmware
- lenovo slim 7-15imh05 firmware
- lenovo slim 7-15itl05 firmware
- lenovo slim 7 16arh7 firmware
Show 33 moreShow less
- lenovo thinkbook 13x itg firmware
- lenovo thinkbook 14 g2 are firmware
- lenovo thinkbook 14 g2 itl firmware
- lenovo thinkbook 14 g3 acl firmware
- lenovo thinkbook 14 g3 itl firmware
- lenovo thinkbook 14 g4\+ ara firmware
- lenovo thinkbook 14 g4\+ iap firmware
- lenovo thinkbook 14p g3 arh firmware
- lenovo thinkbook 14s yoga itl firmware
- lenovo thinkbook 15 g2 are firmware
- lenovo thinkbook 15 g2 itl firmware
- lenovo thinkbook 15 g3 acl firmware
- lenovo thinkbook 15 g3 itl firmware
- lenovo thinkbook 15 gd aba firmware
- lenovo thinkbook 15p g2 ith firmware
- lenovo thinkbook 15p imp firmware
- lenovo thinkbook 16 g4\+ ara firmware
- lenovo thinkbook 16 g4\+ iap firmware
- lenovo thinkbook 16p g3 arh firmware
- lenovo thinkbook 16p nx arh firmware
- lenovo thinkbook plus g2 itg firmware
- lenovo thinkbook plus g3 iap firmware
- lenovo yoga creator 7-15imh05 firmware
- lenovo yoga duet 7-13iml05 firmware
- lenovo yoga duet 7-13itl6-lte firmware
- lenovo yoga duet 7-13itl6 firmware
- lenovo yoga slim 7-14are05 firmware
- lenovo yoga slim 7-14iil05 firmware
- lenovo yoga slim 7-14itl05 firmware
- lenovo yoga slim 7-15iil05 firmware
- lenovo yoga slim 7-15imh05 firmware
- lenovo yoga slim 7-15itl05 firmware
- lenovo yoga slim 7 pro 16arh7 firmware
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-3430 is a medium vulnerability (CVSS 6.7) in Lenovo Bios, published January 23, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.27%, the 18th percentile. No source names a fixed version.