CVE-2022-40135

Severity: medium (CVSS 4.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-01-30 · updated 2026-06-17
Weakness: CWE-125

Description

An information leak vulnerability in the Smart USB Protection SMI Handler in some Lenovo models may allow an attacker with local access and elevated privileges to read SMM memory.

Affected products

Lenovo Ideacentre 3-07Ada05 Firmware: before o4fkt29a — fixed in o4fkt29a
Lenovo Ideacentre 3-07Imb05 Firmware: before m2vkt1da — fixed in m2vkt1da
Lenovo Ideacentre 3 07Iab7 Firmware: before m49kt1da — fixed in m49kt1da
Lenovo Ideacentre 5-14Acn6 Firmware: before o5ekt21a — fixed in o5ekt21a
Lenovo Ideacentre 5-14Are05 Firmware: before o4zkt29a — fixed in o4zkt29a
Lenovo Ideacentre 5-14Imb05 Firmware: before o4hkt38a — fixed in o4hkt38a
Lenovo Ideacentre 5-14Iob6 Firmware: before m3gkt33a — fixed in m3gkt33a
Lenovo Ideacentre 510-15Ick Firmware: before o4kkt16a — fixed in o4kkt16a
Lenovo Ideacentre 510A-15Arr Firmware: before o4dkt43a — fixed in o4dkt43a
Lenovo Ideacentre 510A-15Ick Firmware: before o4kkt16a — fixed in o4kkt16a
Lenovo Ideacentre 510S-07Icb Firmware: before m22kt47a — fixed in m22kt47a
Lenovo Ideacentre 510S-07Ick Firmware: before m30kt26a — fixed in m30kt26a
Lenovo Ideacentre 5 14Iab7 Firmware: before m42kt40a — fixed in m42kt40a
Lenovo Ideacentre 720-18Apr Firmware: before m25kt61a — fixed in m25kt61a
Lenovo Ideacentre A340-22Igm Firmware: before o51kt12a — fixed in o51kt12a
Lenovo Ideacentre A340-24Igm Firmware: before o51kt12a — fixed in o51kt12a
Lenovo Ideacentre C5-14Imb05 Firmware: before o4hkt38a — fixed in o4hkt38a
Lenovo Ideacentre Creator 5-14Iob6 Firmware: through m3gkt33a
Lenovo Ideacentre G5-14Amr05 Firmware: before o4zkt29a — fixed in o4zkt29a
Lenovo Ideacentre G5-14Imb05 Firmware: before o4hkt38a — fixed in o4hkt38a
Lenovo Ideacentre Gaming 5-14Acn6 Firmware: before o5ekt21a — fixed in o5ekt21a
Lenovo Ideacentre Gaming 5-14Iob6 Firmware: before m3gkt33a — fixed in m3gkt33a
Lenovo Ideacentre Gaming 5 17Acn7 Firmware: before o5ekt21a — fixed in o5ekt21a
Lenovo Ideacentre Gaming 5 17Iab7 Firmware: before m42kt40a — fixed in m42kt40a
Lenovo Ideacentre T540-15Ama G Firmware: before m2ckt4da — fixed in m2ckt4da
Lenovo Ideacentre T540-15Ick Firmware: before o4kkt16a — fixed in o4kkt16a
Lenovo Legion C530-19Icb Firmware: before o4bkt20a — fixed in o4bkt20a
Lenovo Legion T5-26Iob6 Firmware: before o54kt1da — fixed in o54kt1da
Lenovo Legion T5-28Icb05 Firmware: before o4bkt20a — fixed in o4bkt20a
Lenovo Legion T530-28Apr Firmware: before o4gkt16a — fixed in o4gkt16a

How to fix

Upgrade to a fixed version: Lenovo Ideacentre 3-07Ada05 Firmware o4fkt29a; Lenovo Ideacentre 3-07Imb05 Firmware m2vkt1da; Lenovo Ideacentre 3 07Iab7 Firmware m49kt1da; Lenovo Ideacentre 5-14Acn6 Firmware o5ekt21a; Lenovo Ideacentre 5-14Are05 Firmware o4zkt29a; Lenovo Ideacentre 5-14Imb05 Firmware o4hkt38a; Lenovo Ideacentre 5-14Iob6 Firmware m3gkt33a; Lenovo Ideacentre 510-15Ick Firmware o4kkt16a; Lenovo Ideacentre 510A-15Arr Firmware o4dkt43a; Lenovo Ideacentre 510A-15Ick Firmware o4kkt16a; Lenovo Ideacentre 510S-07Icb Firmware m22kt47a; Lenovo Ideacentre 510S-07Ick Firmware m30kt26a. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2022-40135 or the next vulnerability affects your stack