CVE-2022-3742

MediumCVSS 6.7/10Last modified Nov 10, 2026

Description

A potential vulnerability was discovered in LCFC BIOS for some Lenovo consumer notebook models that could allow a local attacker with elevated privileges to execute arbitrary code due to improper buffer validation.

Metrics

CVSS 3.1 6.7/10CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-120

Affected software

VendorProductVersions
LenovoNotebookvarious
lenovoideapad_1_14iau7_firmware< jkcn34ww
lenovoideapad_1_14igl7_firmware< kkcn15ww
lenovoideapad_1_15iau7_firmware< jkcn34ww
lenovoideapad_1_15igl7_firmware< kkcn15ww
lenovoideapad_1-14ijl7_firmware< htcn31ww
lenovoideapad_1-15ijl7_firmware< htcn31ww
lenovoideapad_3_14iau7_firmware< jkcn34ww
lenovoideapad_3_15iau7_firmware< jkcn34ww
lenovoideapad_3_17iau7_firmware< jkcn34ww
lenovoideapad_3-15igl05_firmware< dvcn28ww
lenovoideapad_3-17iil05_firmware< emcn56ww
lenovoideapad_3-17itl6_firmware< ggcn51ww
lenovoideapad_5_15ial7_firmware< jbcn27ww
lenovoideapad_5-15itl05_firmware< fhcn70ww
lenovol3-15iml05_firmware< ejcn30ww
lenovol3-15itl6_firmware< gfcn29ww
lenovolegion_5_15iah7_firmware< j2cn49ww
lenovolegion_5_15iah7h_firmware< j2cn49ww
lenovolegion_5_pro_16iah7_firmware< j2cn49ww
lenovolegion_5_pro_16iah7h_firmware< j2cn49ww
lenovolegion_5_pro-16ith6_firmware< h1cn52ww
lenovolegion_5_pro-16ith6h_firmware< h1cn52ww
lenovolegion_5-15imh05_firmware< efcn58ww
lenovolegion_5-15imh05h_firmware< efcn58ww
lenovolegion_5-15imh6_firmware< g8cn22ww
lenovolegion_5-15ith6_firmware< h1cn52ww
lenovolegion_5-15ith6h_firmware< h1cn52ww
lenovolegion_5-17imh05_firmware< efcn58ww
lenovolegion_5-17imh05h_firmware< efcn58ww
lenovolegion_5-17ith6_firmware< h1cn52ww
lenovolegion_5-17ith6h_firmware< h1cn52ww
lenovolegion_5p-15imh05_firmware< efcn58ww
lenovolegion_5p-15imh05h_firmware< efcn58ww
lenovolegion_7_16iax7_firmware< k1cn40ww
lenovolegion_7-16ithg6_firmware< h1cn52ww
lenovos14_g2_itl_firmware< ggcn51ww
lenovos14_g3_iap_firmware< jkcn34ww
lenovoslim_7_14iap7_firmware< jhcn28ww
lenovoslim_7_carbon_13iap7_firmware< k2cn34ww
lenovoslim_7_prox_14iah7_firmware< hmcn41ww
lenovothinkbook_15p_imh_firmware< f6cn26ww
lenovov14_g2_ijl_firmware< htcn31ww
lenovov14_g3_iap_firmware< jkcn34ww
lenovov15_g2_ijl_firmware< htcn31ww
lenovov15_g3_iap_firmware< jkcn34ww
lenovov17_g3_iap_firmware< jkcn34ww
lenovos540-13itl_firmware< fzcn26ww
lenovoslim_7_pro-14ihu5_firmware< fjcn74ww
lenovoslim_9-14itl05_firmware< escn56ww

References

Timeline

Published
Aug 23, 2023
Last modified
Nov 10, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-374215.4Silverstripe silverstripe/cms through 4.11.0 allows XSS.CVE-2022-374227.5Payara through 5.2022.2 allows directory traversal without authentication. This affects Payara Server, Payara Micro, and Payara Server EmbedCVE-2022-374237.5Neo4j APOC (Awesome Procedures on Cypher) before 4.3.0.7 and 4.x before 4.4.0.8 allows Directory Traversal to sibling directories via apoc.lCVE-2022-374246.5Files or Directories Accessible to External Parties vulnerability in OpenNebula on Linux allows File Discovery.CVE-2022-374259.8Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in OpenNebula OpenNebula core on Linux allCVE-2022-374267.5Unrestricted Upload of File with Dangerous Type vulnerability in OpenNebula OpenNebula core on Linux allows File Content Injection.CVE-2022-374286.5PowerDNS Recursor up to and including 4.5.9, 4.6.2 and 4.7.1, when protobuf logging is enabled, has Improper Cleanup upon a Thrown ExceptionCVE-2022-374295.4Silverstripe silverstripe/framework through 4.11 allows XSS (issue 1 of 2) via JavaScript payload to the href attribute of a link by splittiCVE-2022-37434.4A potential vulnerability was discovered in LCFC BIOS for some Lenovo consumer notebook models that could allow a local attacker with elevatCVE-2022-374305.4Silverstripe silverstripe/framework through 4.11 allows XSS vulnerability via href attribute of a link (issue 2 of 2).CVE-2022-374316.1A Reflected Cross-site scripting (XSS) issue was discovered in dotCMS Core through 22.06. This occurs in the admin portal when the configuraCVE-2022-374349.8zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip header extra field. NOTE:
CVE-2022-3742: Medium severity, CVSS 6.7 | Vulnix