CVE-2022-40134

Severity: medium (CVSS 4.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-01-30 · updated 2026-06-17
Weakness: CWE-125

Description

An information leak vulnerability in the SMI Set BIOS Password SMI Handler in some Lenovo models may allow an attacker with local access and elevated privileges to read SMM memory.

Affected products

Lenovo Ideacentre 3-07Ada05 Firmware: o4fkt29a
Lenovo Ideacentre 3-07Imb05 Firmware: m2vkt1da
Lenovo Ideacentre 3 07Iab7 Firmware: m49kt1da
Lenovo Ideacentre 5-14Acn6 Firmware: o5ekt21a
Lenovo Ideacentre 5-14Are05 Firmware: o4zkt29a
Lenovo Ideacentre 5-14Imb05 Firmware: o4hkt38a
Lenovo Ideacentre 5-14Iob6 Firmware: m3gkt33a
Lenovo Ideacentre 510S-07Icb Firmware: m22kt47a, m22kt48a
Lenovo Ideacentre 510S-07Ick Firmware: m30kt26a
Lenovo Ideacentre 5 14Iab7 Firmware: m42kt40a
Lenovo Ideacentre A340-22Igm Firmware: o51kt12a
Lenovo Ideacentre A340-24Igm Firmware: o51kt12a
Lenovo Ideacentre C5-14Imb05 Firmware: o4hkt38a
Lenovo Ideacentre Creator 5-14Iob6 Firmware: m3gkt33a
Lenovo Ideacentre G5-14Amr05 Firmware: o4zkt29a
Lenovo Ideacentre G5-14Imb05 Firmware: o4hkt38a
Lenovo Ideacentre Gaming 5-14Acn6 Firmware: o5ekt21a
Lenovo Ideacentre Gaming 5-14Iob6 Firmware: m3gkt33a
Lenovo Ideacentre Gaming 5 17Acn7 Firmware: o5ekt21a
Lenovo Ideacentre Gaming 5 17Iab7 Firmware: m42kt40a
Lenovo Legion C530-19Icb Firmware: o4bkt20a
Lenovo Legion T5-26Iob6 Firmware: o54kt1da
Lenovo Legion T5-28Icb05 Firmware: o4bkt20a
Lenovo Legion T530-28Apr Firmware: o4gkt16a
Lenovo Legion T530-28Icb Firmware: o4bkt20a
Lenovo Legion T7-34Imz5 Firmware: o4lkt1ea
Lenovo N3310 Storage Firmware: 5.05.0
Lenovo N4610 Storage Firmware: 5.05.0
Lenovo Qitian A815 Firmware: m1rkt38a
Lenovo Qt B415 Firmware: m16kt68a

References

Get alerted when CVE-2022-40134 or the next vulnerability affects your stack