CVE-2022-3431
A potential vulnerability in a driver used during manufacturing process on some consumer Lenovo...
A potential vulnerability in a driver used during manufacturing process on some consumer Lenovo Notebook devices that was mistakenly not deactivated may allow an attacker with elevated privileges to modify secure boot setting by modifying an NVRAM variable.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- High
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
A potential vulnerability in a driver used during manufacturing process on some consumer Lenovo Notebook devices that was mistakenly not deactivated may allow an attacker with elevated privileges to modify secure boot setting by modifying an NVRAM variable.
- Record
CVE-2022-3431- CVSS 3.1
- 6.7 Medium
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-276
- Updated
- 2026-11-02
EUVDEUVD-2022-42807
A potential vulnerability in a driver used during manufacturing process on some consumer Lenovo Notebook devices that was mistakenly not deactivated may allow an attacker with elevated privileges to modify secure boot setting by modifying an NVRAM variable.
- Record
EUVD-2022-42807- CVSS 3.1
- 6.7 Medium
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-jgmr-c4c9-rqmx
A potential vulnerability in a driver used during manufacturing process on some consumer Lenovo...
A potential vulnerability in a driver used during manufacturing process on some consumer Lenovo Notebook devices that was mistakenly not deactivated may allow an attacker with elevated privileges to modify secure boot setting by modifying an NVRAM variable.
- Record
GHSA-jgmr-c4c9-rqmx- CVSS 3.1
- 6.7 Medium
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-276
- Updated
- 2026-11-02
NVD
A potential vulnerability in a driver used during manufacturing process on some consumer Lenovo Notebook devices that was mistakenly not deactivated may allow an attacker with elevated privileges to modify secure boot setting by modifying an NVRAM variable.
- Record
CVE-2022-3431- CVSS 3.1
- 6.7 Medium
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-276
- Updated
- 2026-11-02
Affected products
- lenovo notebook
- lenovo bios
- lenovo d330-10igl firmware
- lenovo ideapad 5 pro-16ach6 firmware
- lenovo ideapad 5 pro-16ihu6 firmware
- lenovo ideapad 5 pro 16arh7 firmware
- lenovo ideapad creator 5-16ach6 firmware
- lenovo ideapad duet 3 10igl5 firmware
- lenovo ideapad slim 7 pro 16ach6 firmware
- lenovo s540-15iml firmware
- lenovo slim 7 16arh7 firmware
- lenovo thinkbook 13x itg firmware
Show 15 moreShow less
- lenovo thinkbook 14 g4\+ ara firmware
- lenovo thinkbook 14 g4\+ iap firmware
- lenovo thinkbook 16 g4\+ ara firmware
- lenovo thinkbook 16 g4\+ iap firmware
- lenovo thinkbook 16p nx arh firmware
- lenovo thinkbook plus g2 itg firmware
- lenovo thinkbook plus g3 iap firmware
- lenovo yoga duet 7-13iml05 firmware
- lenovo yoga duet 7-13itl6-lte firmware
- lenovo yoga duet 7-13itl6 firmware
- lenovo yoga slim 7-13acn05 firmware
- lenovo yoga slim 7-13itl05 firmware
- lenovo yoga slim 7 carbon 13itl5 firmware
- lenovo yoga slim 7 pro 16ach6 firmware
- lenovo yoga slim 7 pro 16arh7 firmware
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-3431 is a medium vulnerability (CVSS 6.7) in Lenovo Notebook, published October 9, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.21%, the 10th percentile. No source names a fixed version.