CVE-2023-4028
A buffer overflow has been identified in the SystemUserMasterHddPwdDxe driver in some Lenovo...
A buffer overflow has been identified in the SystemUserMasterHddPwdDxe driver in some Lenovo Notebook products which may allow an attacker with local access and elevated privileges to execute arbitrary code.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- High
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
A buffer overflow has been identified in the SystemUserMasterHddPwdDxe driver in some Lenovo Notebook products which may allow an attacker with local access and elevated privileges to execute arbitrary code.
- Record
CVE-2023-4028- CVSS 3.1
- 6.7 Medium
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-120
- Updated
- 2026-11-02
EUVDEUVD-2023-53921
A buffer overflow has been identified in the SystemUserMasterHddPwdDxe driver in some Lenovo Notebook products which may allow an attacker with local access and elevated privileges to execute arbitrary code.
- Record
EUVD-2023-53921- CVSS 3.1
- 6.7 Medium
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-xgcf-cppw-j442
A buffer overflow has been identified in the SystemUserMasterHddPwdDxe driver in some Lenovo...
A buffer overflow has been identified in the SystemUserMasterHddPwdDxe driver in some Lenovo Notebook products which may allow an attacker with local access and elevated privileges to execute arbitrary code.
- Record
GHSA-xgcf-cppw-j442- CVSS 3.1
- 6.7 Medium
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-120
- Updated
- 2026-11-02
NVD
A buffer overflow has been identified in the SystemUserMasterHddPwdDxe driver in some Lenovo Notebook products which may allow an attacker with local access and elevated privileges to execute arbitrary code.
- Record
CVE-2023-4028- CVSS 3.1
- 6.7 Medium
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-120
- Updated
- 2026-11-02
Affected products
- lenovo notebook
- lenovo 13w yoga
- lenovo 13w yoga firmware
- lenovo 13w yoga gen 2
- lenovo 13w yoga gen 2 firmware
- lenovo flex 5-14alc05 firmware
- lenovo flex 5-14are05
- lenovo flex 5-14are05 firmware
- lenovo flex 5-14iil05
- lenovo flex 5-14iil05 firmware
- lenovo flex 5-14itl05
- lenovo flex 5-14itl05 firmware
Show 49 moreShow less
- lenovo flex 5-15alc05
- lenovo flex 5-15alc05 firmware
- lenovo flex 5-15iil05
- lenovo flex 5-15iil05 firmware
- lenovo flex 5-15itl05
- lenovo flex 5-15itl05 firmware
- lenovo flex 7 14iau7 firmware
- lenovo flex 7 14iru8
- lenovo flex 7 14iru8 firmware
- lenovo ideapad 1-11ada05
- lenovo ideapad 1-11ada05 firmware
- lenovo ideapad 1-11igl05
- lenovo ideapad 1-11igl05 firmware
- lenovo ideapad 1-14ada05
- lenovo ideapad 1-14ada05 firmware
- lenovo ideapad 1-14igl05
- lenovo ideapad 1-14igl05 firmware
- lenovo ideapad 5-14alc05
- lenovo ideapad 5-15alc05
- lenovo ideapad flex 5 14abr8
- lenovo ideapad flex 5 14abr8 firmware
- lenovo ideapad flex 5 14alc7
- lenovo ideapad flex 5 14alc7 firmware
- lenovo ideapad flex 5 14iau7
- lenovo ideapad flex 5 14iau7 firmware
- lenovo ideapad flex 5 14iru8
- lenovo ideapad flex 5 14iru8 firmware
- lenovo ideapad flex 5 16abr8
- lenovo ideapad flex 5 16abr8 firmware
- lenovo ideapad flex 5 16alc7
- lenovo ideapad flex 5 16alc7 firmware
- lenovo ideapad flex 5 16iau7
- lenovo ideapad flex 5 16iau7 firmware
- lenovo ideapad flex 5 16iru8
- lenovo ideapad flex 5 16iru8 firmware
- lenovo thinkbook 13s g2 are
- lenovo thinkbook 13s g2 are firmware
- lenovo thinkbook 13s g2 itl
- lenovo thinkbook 13s g2 itl firmware
- lenovo thinkbook 13s g3 acn
- lenovo thinkbook 13s g3 acn firmware
- lenovo thinkbook 13s g4 iap
- lenovo thinkbook 13s g4 iap firmware
- lenovo thinkbook 13x g2 iap
- lenovo thinkbook 13x g2 iap firmware
- lenovo thinkbook 14s g2 itl
- lenovo thinkbook 14s g2 itl firmware
- lenovo yoga 9-15imh5
- lenovo yoga 9-15imh5 firmware
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-4028 is a medium vulnerability (CVSS 6.7) in Lenovo Notebook, published August 17, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.19%, the 9th percentile. No source names a fixed version.