CVE-2022-3430

Severity: medium (CVSS 6.7 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-01-23 · updated 2026-06-17
Weakness: CWE-276

Description

A potential vulnerability in the WMI Setup driver on some consumer Lenovo Notebook devices may allow an attacker with elevated privileges to modify secure boot setting by modifying an NVRAM variable.

Affected products

Lenovo D330-10Igl Firmware: before g0cn11ww — fixed in g0cn11ww
Lenovo Ideapad 5 Pro 16Arh7 Firmware: before j5cn27ww — fixed in j5cn27ww
Lenovo Ideapad 5 Pro 16Iah7 Firmware: before j4cn33ww — fixed in j4cn33ww
Lenovo IdeaPad Duet 3-10IGL5: before eqcn37ww — fixed in eqcn37ww
Lenovo Ideapad Slim 7-14Iil05 Firmware: before dhcn35ww — fixed in dhcn35ww
Lenovo Ideapad Slim 7-14Itl05 Firmware: before fbcn29ww — fixed in fbcn29ww
Lenovo Ideapad Slim 7-15Iil05 Firmware: before dhcn35ww — fixed in dhcn35ww
Lenovo Slim 7-14Are05 Firmware: before dmcn43ww — fixed in dmcn43ww
Lenovo Slim 7-15Imh05 Firmware: before dncn32ww — fixed in dncn32ww
Lenovo Slim 7-15Itl05 Firmware: before fbcn29ww — fixed in fbcn29ww
Lenovo Slim 7 16Arh7 Firmware: before klcn15ww — fixed in klcn15ww
Lenovo Thinkbook 13X Itg Firmware: before hlcn30ww — fixed in hlcn30ww
Lenovo Thinkbook 14 G2 Are Firmware: before facn33ww — fixed in facn33ww
Lenovo Thinkbook 14 G2 Itl Firmware: before f8cn52ww — fixed in f8cn52ww
Lenovo Thinkbook 14 G3 Acl Firmware: before gqcn35ww_hfcn30ww — fixed in gqcn35ww_hfcn30ww
Lenovo Thinkbook 14 G3 Itl Firmware: before hrcn13ww — fixed in hrcn13ww
Lenovo Thinkbook 14 G4+ Ara Firmware: before j6cn40ww — fixed in j6cn40ww
Lenovo Thinkbook 14 G4+ Iap Firmware: before hycn40ww — fixed in hycn40ww
Lenovo Thinkbook 14P G3 Arh Firmware: before k4cn31ww — fixed in k4cn31ww
Lenovo Thinkbook 14S Yoga Itl Firmware: before fncn40ww — fixed in fncn40ww
Lenovo Thinkbook 15 G2 Are Firmware: before facn33ww — fixed in facn33ww
Lenovo Thinkbook 15 G2 Itl Firmware: before f8cn52ww — fixed in f8cn52ww
Lenovo Thinkbook 15 G3 Acl Firmware: before gqcn35ww_hfcn30ww — fixed in gqcn35ww_hfcn30ww
Lenovo Thinkbook 15 G3 Itl Firmware: before hrcn13ww — fixed in hrcn13ww
Lenovo Thinkbook 15 Gd Aba Firmware: before jpcn20ww — fixed in jpcn20ww
Lenovo Thinkbook 15P G2 Ith Firmware: before hjcn31ww — fixed in hjcn31ww
Lenovo Thinkbook 15P Imp Firmware: before f6cn25ww — fixed in f6cn25ww
Lenovo Thinkbook 16 G4+ Ara Firmware: before j6cn40ww — fixed in j6cn40ww
Lenovo Thinkbook 16 G4+ Iap Firmware: before hycn40ww — fixed in hycn40ww
Lenovo Thinkbook 16P G3 Arh Firmware: before kccn31ww — fixed in kccn31ww

How to fix

Upgrade to a fixed version: Lenovo D330-10Igl Firmware g0cn11ww; Lenovo Ideapad 5 Pro 16Arh7 Firmware j5cn27ww; Lenovo Ideapad 5 Pro 16Iah7 Firmware j4cn33ww; Lenovo IdeaPad Duet 3-10IGL5 eqcn37ww; Lenovo Ideapad Slim 7-14Iil05 Firmware dhcn35ww; Lenovo Ideapad Slim 7-14Itl05 Firmware fbcn29ww; Lenovo Ideapad Slim 7-15Iil05 Firmware dhcn35ww; Lenovo Slim 7-14Are05 Firmware dmcn43ww; Lenovo Slim 7-15Imh05 Firmware dncn32ww; Lenovo Slim 7-15Itl05 Firmware fbcn29ww; Lenovo Slim 7 16Arh7 Firmware klcn15ww; Lenovo Thinkbook 13X Itg Firmware hlcn30ww. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2022-3430 or the next vulnerability affects your stack