CVE-2023-4029

MediumCVSS 6.7/10Last modified Jun 17, 2026

Description

A buffer overflow has been identified in the BoardUpdateAcpiDxe driver in some Lenovo ThinkPad products which may allow an attacker with local access and elevated privileges to execute arbitrary code.

Metrics

CVSS 3.1 6.7/10CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-120

Affected software

No affected versions have been published.

Timeline

Published: Aug 17, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-402908.3An issue was discovered on Supermicro X11SSM-F, X11SAE-F, and X11SSE-F 1.66 devices. An attacker could exploit an XSS issue that affects Int CVE-2023-402916.8Harman Infotainment 20190525031613 allows root access via SSH over a USB-to-Ethernet dongle with a password that is an internal project name CVE-2023-402924.3Harman Infotainment 20190525031613 and later discloses the IP address via CarPlay CTRL packets.CVE-2023-402936.8Harman Infotainment 20190525031613 and later allows command injection via unauthenticated RPC with a D-Bus connection object.CVE-2023-402946.5libboron in Boron 2.0.8 has a heap-based buffer overflow in ur_parseBlockI at i_parse_blk.c.CVE-2023-402958.8libboron in Boron 2.0.8 has a heap-based buffer overflow in ur_strInitUtf8 at string.c.CVE-2023-402967.5async-sockets-cpp through 0.3.1 has a stack-based buffer overflow in ReceiveFrom and Receive in udpsocket.hpp when processing malformed UDP CVE-2023-402977.5Stakater Forecastle 1.0.139 and before allows %5C../ directory traversal in the website component.CVE-2023-402997.8Kong Insomnia 2023.4.0 on macOS allows attackers to execute code and access restricted files, or make requests for TCC permissions, by using CVE-2023-40307.8A vulnerability was reported in BIOS for ThinkPad P14s Gen 2, P15s Gen 2, T14 Gen 2, and T15 Gen 2 that could cause the system to recover to CVE-2023-403009.8NETSCOUT nGeniusPULSE 3.8 has a Hardcoded Cryptographic Key.CVE-2023-403019.8NETSCOUT nGeniusPULSE 3.8 has a Command Injection Vulnerability.