What’s Vulnerable › Vulnerabilities

CVE-2022-40137

• Severity: medium (CVSS 6.7 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-01-30 · updated 2026-06-17
• Weakness: CWE-120

Description

A buffer overflow in the WMI SMI Handler in some Lenovo models may allow an attacker with local access and elevated privileges to execute arbitrary code.

Affected products

• Lenovo Ideacentre 3-07Ada05 Firmware: o4fkt33a
• Lenovo Ideacentre 3-07Imb05 Firmware: m2vkt1fa
• Lenovo Ideacentre 3 07Iab7 Firmware: m49kt1da
• Lenovo Ideacentre 5-14Acn6 Firmware: o5ekt23a
• Lenovo Ideacentre 5-14Are05 Firmware: o4zkt29a
• Lenovo Ideacentre 5-14Imb05 Firmware: o4hkt3aa
• Lenovo Ideacentre 5-14Iob6 Firmware: m3gkt38a
• Lenovo Ideacentre 510-15Ick Firmware: o4kkt16a
• Lenovo Ideacentre 510A-15Arr Firmware: o4dkt44a
• Lenovo Ideacentre 510A-15Ick Firmware: o4kkt16a
• Lenovo Ideacentre 510S-07Icb Firmware: m22kt48a
• Lenovo Ideacentre 510S-07Ick Firmware: m30kt27a
• Lenovo Ideacentre 5 14Iab7 Firmware: m42kt40a
• Lenovo Ideacentre 720-18Apr Firmware: m25kt61a
• Lenovo Ideacentre A340-22Ast All-In-One Firmware: o4ckt23a
• Lenovo Ideacentre A340-22Icb All-In-One Firmware: o44kt32a
• Lenovo Ideacentre A340-22Ick All-In-One Firmware: o4pkt15a
• Lenovo Ideacentre A340-22Igm All-In-One Firmware: o51kt12a
• Lenovo Ideacentre A340-22Iwl All-In-One Firmware: o46kt36a
• Lenovo Ideacentre A340-24Icb All-In-One Firmware: o44kt32a
• Lenovo Ideacentre A340-24Ick All-In-One Firmware: o4pkt15a
• Lenovo Ideacentre A340-24Igm All-In-One Firmware: o51kt12a
• Lenovo Ideacentre A340-24Iwl All-In-One Firmware: o46kt36a
• Lenovo Ideacentre Aio 3-22Ada05 Firmware: o4tkt29a
• Lenovo Ideacentre Aio 3-22Ada6 Firmware: o5ckt24a
• Lenovo Ideacentre Aio 3-22Iil5 Firmware: o56kt22a
• Lenovo Ideacentre Aio 3-22Imb05 Firmware: o4rkt3a
• Lenovo Ideacentre Aio 3-22Itl6 Firmware: o5akt31a
• Lenovo Ideacentre Aio 3-24Ada6 Firmware: o5ckt24a
• Lenovo Ideacentre Aio 3-24Alc6 Firmware: o5bkt24a

References

• https://support.lenovo.com/us/en/product_security/LEN-94953
• https://support.lenovo.com/us/en/product_security/LEN-94953

Get alerted when CVE-2022-40137 or the next vulnerability affects your stack