{"id":"CVE-2023-45075","aliases":["EUVD-2023-49396","GHSA-cjpq-3xp9-4722"],"status":"published","title":"A memory leakage vulnerability was reported in the SWSMI_Shadow DXE driver that may allow a local...","description":"A memory leakage vulnerability was reported in the SWSMI_Shadow DXE driver that may allow a local attacker with elevated privileges to write to NVRAM variables.","severity":{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-08","score":0.00236,"percentile":0.14642,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-125"],"published":"2023-11-08T22:27:32Z","modified":"2026-06-17T06:28:12Z","products":[{"vendor":"lenovo","product":"bios"},{"vendor":"lenovo","product":"ideacentre_3-07ada05_firmware"},{"vendor":"lenovo","product":"ideacentre_3-07imb05_firmware"},{"vendor":"lenovo","product":"ideacentre_5-14iob6_firmware"},{"vendor":"lenovo","product":"ideacentre_c5-14imb05_firmware"},{"vendor":"lenovo","product":"ideacentre_creator_5-14iob6_firmware"},{"vendor":"lenovo","product":"ideacentre_g5-14amr05_firmware"},{"vendor":"lenovo","product":"ideacentre_g5-14imb05_firmware"},{"vendor":"lenovo","product":"ideacentre_gaming_5-14iob6_firmware"},{"vendor":"lenovo","product":"ideacentre_mini_5-01imh05_firmware"},{"vendor":"lenovo","product":"ideacentre_mini_5_01iaq7_firmware"},{"vendor":"lenovo","product":"legion_t7-34imz5_firmware"},{"vendor":"lenovo","product":"thinkcentre_m625q_firmware"},{"vendor":"lenovo","product":"thinkcentre_m630e_firmware"},{"vendor":"lenovo","product":"thinkcentre_m70a_firmware"},{"vendor":"lenovo","product":"thinkcentre_m70c_firmware"},{"vendor":"lenovo","product":"thinkcentre_m70q_firmware"},{"vendor":"lenovo","product":"thinkcentre_m70s_firmware"},{"vendor":"lenovo","product":"thinkcentre_m70t_firmware"},{"vendor":"lenovo","product":"thinkcentre_m720q_firmware"},{"vendor":"lenovo","product":"thinkcentre_m720s_firmware"},{"vendor":"lenovo","product":"thinkcentre_m720t_firmware"},{"vendor":"lenovo","product":"thinkcentre_m75n_firmware"},{"vendor":"lenovo","product":"thinkcentre_m75q_gen_2_firmware"},{"vendor":"lenovo","product":"thinkcentre_m75s_gen_2_firmware"},{"vendor":"lenovo","product":"thinkcentre_m75t_gen_2_firmware"},{"vendor":"lenovo","product":"thinkcentre_m80q_firmware"},{"vendor":"lenovo","product":"thinkcentre_m80s_firmware"},{"vendor":"lenovo","product":"thinkcentre_m80t_firmware"},{"vendor":"lenovo","product":"thinkcentre_m820z_all-in-one_firmware"},{"vendor":"lenovo","product":"thinkcentre_m90a_firmware"},{"vendor":"lenovo","product":"thinkcentre_m90q_tiny_firmware"},{"vendor":"lenovo","product":"thinkcentre_m90s_firmware"},{"vendor":"lenovo","product":"thinkcentre_m90t_firmware"},{"vendor":"lenovo","product":"thinkcentre_m920q_firmware"},{"vendor":"lenovo","product":"thinkcentre_m920s_firmware"},{"vendor":"lenovo","product":"thinkcentre_m920t_firmware"},{"vendor":"lenovo","product":"thinkcentre_m920x_firmware"},{"vendor":"lenovo","product":"thinkcentre_m920z_all-in-one_firmware"},{"vendor":"lenovo","product":"thinkedge_se30_firmware"},{"vendor":"lenovo","product":"thinkstation_p320_workstation_firmware"},{"vendor":"lenovo","product":"thinkstation_p330_tiny_workstation_firmware"},{"vendor":"lenovo","product":"thinkstation_p330_workstation_2nd_gen_firmware"},{"vendor":"lenovo","product":"thinkstation_p330_workstation_firmware"},{"vendor":"lenovo","product":"thinkstation_p340_tiny_workstation_firmware"},{"vendor":"lenovo","product":"thinkstation_p340_workstation_firmware"},{"vendor":"lenovo","product":"thinkstation_p348_workstation_firmware"},{"vendor":"lenovo","product":"thinkstation_p350_workstation_firmware"},{"vendor":"lenovo","product":"thinkstation_p360_workstation_firmware"},{"vendor":"lenovo","product":"thinkstation_p520_workstation_firmware"},{"vendor":"lenovo","product":"thinkstation_p520c_workstation_firmware"},{"vendor":"lenovo","product":"thinkstation_p720_workstation_firmware"},{"vendor":"lenovo","product":"thinkstation_p920_workstation_firmware"},{"vendor":"lenovo","product":"v30a-22iml_firmware"},{"vendor":"lenovo","product":"v30a-24iml_firmware"},{"vendor":"lenovo","product":"v50a-22imb_firmware"},{"vendor":"lenovo","product":"v50a-24imb_firmware"},{"vendor":"lenovo","product":"v50s-07imb_firmware"},{"vendor":"lenovo","product":"v50t-13imb_firmware"},{"vendor":"lenovo","product":"v50t-13imh_firmware"},{"vendor":"lenovo","product":"v50t-13iob_g2_firmware"},{"vendor":"lenovo","product":"v55t_gen_2_13acn_firmware"}],"references":[{"url":"https://support.lenovo.com/us/en/product_security/LEN-141775","tags":["x_transferred","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-45075"},{"url":"https://github.com/advisories/GHSA-cjpq-3xp9-4722"}],"sources":{"cve":[{"id":"CVE-2023-45075","description":"A memory leakage vulnerability was reported in the SWSMI_Shadow DXE driver that may allow a local attacker with elevated privileges to write to NVRAM variables.","status":"published","published":"2023-11-08T22:27:32.659Z","modified":"2024-09-04T17:58:47.396Z","cvss":[{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:35:22.640346Z"}],"euvd":[{"id":"EUVD-2023-49396","description":"A memory leakage vulnerability was reported in the SWSMI_Shadow DXE driver that may allow a local attacker with elevated privileges to write to NVRAM variables.","status":"published","published":"2023-11-08T22:27:32Z","modified":"2024-09-04T17:58:47Z","cvss":[{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"medium"}],"updated_at":"2026-11-03T00:56:04.166522Z"}],"ghsa":[{"id":"GHSA-cjpq-3xp9-4722","title":"A memory leakage vulnerability was reported in the SWSMI_Shadow DXE driver that may allow a local...","description":"A memory leakage vulnerability was reported in the SWSMI_Shadow DXE driver that may allow a local attacker with elevated privileges to write to NVRAM variables.","status":"published","published":"2023-11-09T00:33:57Z","modified":"2023-11-09T00:33:57Z","cvss":[{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"medium"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:54:55.524004Z"}],"nvd":[{"id":"CVE-2023-45075","description":"A memory leakage vulnerability was reported in the SWSMI_Shadow DXE driver that may allow a local attacker with elevated privileges to write to NVRAM variables.","status":"published","published":"2023-11-08T23:15:10.9Z","modified":"2026-06-17T06:28:12.447Z","cvss":[{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"medium","assessor":"secondary"},{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"medium","assessor":"primary"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:08:43.669554Z"}]}}