What’s Vulnerable › Vulnerabilities

CVE-2022-3744

• Severity: medium (CVSS 6.7 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-08-23 · updated 2026-06-17
• Weakness: CWE-798

Description

A potential vulnerability was discovered in LCFC BIOS for some Lenovo consumer notebook models that could allow a local attacker with elevated privileges to unlock UEFI variables due to a hard-coded SMI handler credential.

Affected products

• Lenovo Ideapad 1-14Ijl7 Firmware: before htcn31ww — fixed in htcn31ww
• Lenovo Ideapad 1-15Ijl7 Firmware: before htcn31ww — fixed in htcn31ww
• Lenovo Ideapad 1 14Iau7 Firmware: before jkcn34ww — fixed in jkcn34ww
• Lenovo Ideapad 1 14Igl7 Firmware: before kkcn15ww — fixed in kkcn15ww
• Lenovo Ideapad 1 15Iau7 Firmware: before jkcn34ww — fixed in jkcn34ww
• Lenovo Ideapad 1 15Igl7 Firmware: before kkcn15ww — fixed in kkcn15ww
• Lenovo Ideapad 3-14Igl05 Firmware: before dvcn28ww — fixed in dvcn28ww
• Lenovo Ideapad 3-14Iil05 Firmware: before emcn56ww — fixed in emcn56ww
• Lenovo Ideapad 3-14Iml05 Firmware: before dxcn44ww — fixed in dxcn44ww
• Lenovo Ideapad 3-14Itl05 Firmware: before gccn32ww — fixed in gccn32ww
• Lenovo Ideapad 3-14Itl6 Firmware: before ggcn51ww — fixed in ggcn51ww
• Lenovo Ideapad 3-15Igl05 Firmware: before dvcn28ww — fixed in dvcn28ww
• Lenovo Ideapad 3-15Iil05 Firmware: before emcn56ww — fixed in emcn56ww
• Lenovo Ideapad 3-15Iml05 Firmware: before dxcn44ww — fixed in dxcn44ww
• Lenovo Ideapad 3-15Itl05 Firmware: before gccn32ww — fixed in gccn32ww
• Lenovo Ideapad 3-15Itl6 Firmware: before ggcn51ww — fixed in ggcn51ww
• Lenovo Ideapad 3-17Iil05 Firmware: before emcn56ww — fixed in emcn56ww
• Lenovo Ideapad 3-17Iml05 Firmware: before dxcn44ww — fixed in dxcn44ww
• Lenovo Ideapad 3-17Itl6 Firmware: before ggcn51ww — fixed in ggcn51ww
• Lenovo Ideapad 3 14Iau7 Firmware: before jkcn34ww — fixed in jkcn34ww
• Lenovo Ideapad 3 15Iau7 Firmware: before jkcn34ww — fixed in jkcn34ww
• Lenovo Ideapad 3 17Iau7 Firmware: before jkcn34ww — fixed in jkcn34ww
• Lenovo Ideapad 5-15Iil05 Firmware: before dpcn58ww — fixed in dpcn58ww
• Lenovo Ideapad 5-15Itl05 Firmware: before fhcn70ww — fixed in fhcn70ww
• Lenovo Ideapad 5 15Ial7 Firmware: before jbcn27ww — fixed in jbcn27ww
• Lenovo Ideapad Creator 5-15Imh05 Firmware: before egcn40ww — fixed in egcn40ww
• Lenovo Ideapad Gaming 3-15Imh05 Firmware: before egcn40ww — fixed in egcn40ww
• Lenovo L3-15Iml05 Firmware: before ejcn30ww — fixed in ejcn30ww
• Lenovo L3-15Itl6 Firmware: before gfcn29ww — fixed in gfcn29ww
• Lenovo Legion 5-15Imh05 Firmware: before efcn58ww — fixed in efcn58ww

How to fix

Upgrade to a fixed version: Lenovo Ideapad 1-14Ijl7 Firmware htcn31ww; Lenovo Ideapad 1-15Ijl7 Firmware htcn31ww; Lenovo Ideapad 1 14Iau7 Firmware jkcn34ww; Lenovo Ideapad 1 14Igl7 Firmware kkcn15ww; Lenovo Ideapad 1 15Iau7 Firmware jkcn34ww; Lenovo Ideapad 1 15Igl7 Firmware kkcn15ww; Lenovo Ideapad 3-14Igl05 Firmware dvcn28ww; Lenovo Ideapad 3-14Iil05 Firmware emcn56ww; Lenovo Ideapad 3-14Iml05 Firmware dxcn44ww; Lenovo Ideapad 3-14Itl05 Firmware gccn32ww; Lenovo Ideapad 3-14Itl6 Firmware ggcn51ww; Lenovo Ideapad 3-15Igl05 Firmware dvcn28ww. Check the vendor advisory for mitigations.

References

• https://support.lenovo.com/us/en/product_security/LEN-103710
• https://support.lenovo.com/us/en/product_security/LEN-103710

Get alerted when CVE-2022-3744 or the next vulnerability affects your stack