CVE-2022-4574

MediumCVSS 6.7/10Last modified Jun 17, 2026

Description

An SMI handler input validation vulnerability in the BIOS of some ThinkPad models could allow an attacker with local access and elevated privileges to execute arbitrary code.

Metrics

CVSS 3.1 6.7/10CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-20

Affected software

No affected versions have been published.

Timeline

Published
Oct 30, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-457488.8An issue was discovered with assimp 5.1.4, a use after free occurred in function ColladaParser::ExtractDataObjectFromChannel in file /code/ACVE-2022-45756.7A vulnerability due to improper write protection of UEFI variables was reported in the BIOS of some ThinkPad models could allow an attacker CVE-2022-457555.4Cross-site scripting (XSS) vulnerability in EyouCMS v1.6.0 allows attackers to execute arbitrary code via the home page description on the bCVE-2022-457566.1SENS v1.0 is vulnerable to Cross Site Scripting (XSS).CVE-2022-457585.4SENS v1.0 is vulnerable to Cross Site Scripting (XSS) via com.liuyanzhao.sens.web.controller.admin, getRegister.CVE-2022-457598.8SENS v1.0 has a file upload vulnerability.CVE-2022-45765.4The Easy Bootstrap Shortcode WordPress plugin through 4.5.4 does not validate and escape some of its shortcode attributes before outputting CVE-2022-457608.8SENS v1.0 is vulnerable to Incorrect Access Control vulnerability.CVE-2022-457669.1Hardcoded credentials in Global Facilities Management Software (GFMS) Version 3 software distributed by Key Systems Management permits remotCVE-2022-457688.8Command Injection vulnerability in Edimax Technology Co., Ltd. Wireless Router N300 Firmware BR428nS v3 allows attacker to execute arbitraryCVE-2022-457696.1A cross-site scripting (XSS) vulnerability in ClicShopping_V3 v3.402 allows attackers to execute arbitrary web scripts or HTML via a craftedCVE-2022-45775.4The Easy Testimonials WordPress plugin before 3.9.3 does not validate and escape some of its shortcode attributes before outputting them bac
CVE-2022-4574: Medium severity, CVSS 6.7 | Vulnix