CVE-2022-3744

MediumCVSS 6.7/10Last modified Nov 10, 2026

Description

A potential vulnerability was discovered in LCFC BIOS for some Lenovo consumer notebook models that could allow a local attacker with elevated privileges to unlock UEFI variables due to a hard-coded SMI handler credential.

Metrics

CVSS 3.1 6.7/10CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-798

Affected software

Vendor	Product	Versions
Lenovo	Notebook	various

References

https://support.lenovo.com/us/en/product_security/LEN-103710Vendor Advisory
https://support.lenovo.com/us/en/product_security/LEN-103710Vendor Advisory

Timeline

Published: Aug 23, 2023
Last modified: Nov 10, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-37454.4A potential vulnerability was discovered in LCFC BIOS for some Lenovo consumer notebook models that could allow a local attacker with elevat CVE-2022-374505.9Go Ethereum (aka geth) through 1.10.21 allows attackers to increase rewards by mining blocks in certain situations, and using a manipulation CVE-2022-374517.5Exim before 4.96 has an invalid free in pam_converse in auths/call_pam.c because store_free is not used after store_malloc.CVE-2022-374529.8Exim before 4.95 has a heap-based buffer overflow for the alias list in host_name_lookup in host.c when sender_host_name is set.CVE-2022-374537.5An issue was discovered in Softing OPC UA C++ SDK before 6.10. A buffer overflow or an excess allocation happens due to unchecked array and CVE-2022-374549.8The Keccak XKCP SHA-3 reference implementation before fdc6fef has an integer overflow and resultant buffer overflow that allows attackers to CVE-2022-374587.2Discourse through 2.8.7 allows admins to send invitations to arbitrary email addresses at an unlimited rate.CVE-2022-374597.8Ampere Altra devices before 1.08g and Ampere Altra Max devices before 2.05a allow attackers to control the predictions for return addresses CVE-2022-37466.7A potential vulnerability was discovered in LCFC BIOS for some Lenovo consumer notebook models that could allow a local attacker with elevat CVE-2022-374616.1Multiple cross-site scripting (XSS) vulnerabilities in Canon Medical Vitrea View 7.x before 7.7.6 allow remote attackers to inject arbitrary CVE-2022-374625.4A stored Cross-Site Scripting (XSS) vulnerability in the Chat gadget in Upstream Works Agent Desktop for Cisco Finesse through 4.2.12 and 5.CVE-2022-37476.5The Becustom plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.5.2. This is due to miss