CVE-2022-48189

MediumCVSS 6.7/10Last modified Jun 17, 2026

Description

An SMM driver input validation vulnerability in the BIOS of some ThinkPad models could allow an attacker with local access and elevated privileges to execute arbitrary code.

Metrics

CVSS 3.1 6.7/10CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-20

Affected software

Vendor	Product	Versions
Lenovo	ThinkPad BIOS	various
lenovo	thinkpad	various

References

https://support.lenovo.com/us/en/product_security/LEN-106014Vendor Advisory
https://support.lenovo.com/us/en/product_security/LEN-106014Vendor Advisory

Timeline

Published: Oct 30, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-48196.1A vulnerability was found in HotCRP. It has been rated as problematic. Affected by this issue is some unknown functionality. The manipulatio CVE-2022-481917.0A vulnerability exists in Trend Micro Maximum Security 2022 (17.7) wherein a low-privileged user can write a known malicious executable to a CVE-2022-481926.1Cross-site Scripting vulnerability in Softing smartLink SW-HT before 1.30, which allows an attacker to execute a dynamic script (JavaScript,CVE-2022-481937.5Weak ciphers in Softing smartLink SW-HT before 1.30 are enabled during secure communication (SSL).CVE-2022-481948.8TP-Link TL-WR902AC devices through V3 0.9.1 allow remote authenticated attackers to execute arbitrary code or cause a Denial of Service (DoS CVE-2022-481959.8An issue was discovered in Mellium mellium.im/sasl before 0.3.1. When performing SCRAM-based SASL authentication, if the remote end advertis CVE-2022-481969.8Certain NETGEAR devices are affected by a buffer overflow by an unauthenticated attacker. This affects RAX40 before 1.0.2.60, RAX35 before 1 CVE-2022-481976.1Reflected cross-site scripting (XSS) exists in Sandbox examples in the YUI2 repository. The download distributions, TreeView component and t CVE-2022-481989.8The ntpd_driver component before 1.3.0 and 2.x before 2.2.0 for Robot Operating System (ROS) allows attackers, who control the source code o CVE-2022-481998.8SoftPerfect NetWorx 7.1.1 on Windows allows an attacker to execute a malicious binary with potentially higher privileges via a low-privilege CVE-2022-48206.1A vulnerability classified as problematic has been found in FlatPress. This affects an unknown part of the file admin/panels/entry/admin.ent CVE-2022-48216.1A vulnerability classified as problematic was found in FlatPress. This vulnerability affects the function onupload of the file admin/panels/