CVE-2022-48188
A buffer overflow vulnerability in the SecureBootDXE BIOS driver of some Lenovo Desktop and...
A buffer overflow vulnerability in the SecureBootDXE BIOS driver of some Lenovo Desktop and ThinkStation models could allow an attacker with local access to elevate their privileges to execute arbitrary code.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- High
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
A buffer overflow vulnerability in the SecureBootDXE BIOS driver of some Lenovo Desktop and ThinkStation models could allow an attacker with local access to elevate their privileges to execute arbitrary code.
- Record
CVE-2022-48188- CVSS 3.1
- 6.7 Medium
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-787
- Updated
- 2026-11-02
EUVDEUVD-2022-50899
A buffer overflow vulnerability in the SecureBootDXE BIOS driver of some Lenovo Desktop and ThinkStation models could allow an attacker with local access to elevate their privileges to execute arbitrary code.
- Record
EUVD-2022-50899- CVSS 3.1
- 6.7 Medium
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-44q7-gj7w-2qrj
A buffer overflow vulnerability in the SecureBootDXE BIOS driver of some Lenovo Desktop and...
A buffer overflow vulnerability in the SecureBootDXE BIOS driver of some Lenovo Desktop and ThinkStation models could allow an attacker with local access to elevate their privileges to execute arbitrary code.
- Record
GHSA-44q7-gj7w-2qrj- CVSS 3.1
- 6.7 Medium
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-787
- Updated
- 2026-11-02
NVD
A buffer overflow vulnerability in the SecureBootDXE BIOS driver of some Lenovo Desktop and ThinkStation models could allow an attacker with local access to elevate their privileges to execute arbitrary code.
- Record
CVE-2022-48188- CVSS 3.1
- 6.7 Medium
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-787
- Updated
- 2026-11-02
Affected products
- lenovo ideacentre 510s-07icb firmware
- lenovo ideacentre 510s-07ick firmware
- lenovo ideacentre 720-18apr firmware
- lenovo ideacentre aio 3-22itl6 firmware
- lenovo ideacentre aio 3-24itl6 firmware
- lenovo ideacentre aio 3-27itl6 firmware
- lenovo ideacentre aio 3 21itl7 firmware
- lenovo thinkcentre m720e firmware
- lenovo thinkcentre m720q firmware
- lenovo thinkcentre m720s firmware
- lenovo thinkcentre m720t firmware
- lenovo thinkcentre m725s firmware
Show 16 moreShow less
- lenovo thinkcentre m75s gen 2 firmware
- lenovo thinkcentre m75t gen 2 firmware
- lenovo thinkcentre m920q firmware
- lenovo thinkcentre m920s firmware
- lenovo thinkcentre m920t firmware
- lenovo thinkcentre m920x firmware
- lenovo thinkcentre m920z firmware
- lenovo thinkstation bios
- lenovo thinkstation p330 tiny firmware
- lenovo thinkstation p360 ultra firmware
- lenovo thinkstation p520 firmware
- lenovo thinkstation p520c firmware
- lenovo v30a-22itl firmware
- lenovo v30a-24itl firmware
- lenovo v530s-07icb firmware
- lenovo v530s-07icr firmware
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-48188 is a medium vulnerability (CVSS 6.7) in Lenovo Ideacentre 510s-07icb Firmware, published June 5, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.19%, the 8th percentile. No source names a fixed version.