What’s Vulnerable › Vulnerabilities

CVE-2022-48181

• Severity: high (CVSS 7.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-06-05 · updated 2026-06-17
• Weakness: CWE-787

Description

An ErrorMessage driver stack-based buffer overflow vulnerability in BIOS of some ThinkPad models could allow an attacker with local access to elevate their privileges and execute arbitrary code.

Affected products

• Lenovo Ideacentre 3-07Ada05 Firmware: before o4fkt35a; before m4mkt12a — fixed in m4mkt12a, o4fkt35a
• Lenovo Ideacentre 3-07Imb05 Firmware: before m2vkt1ea — fixed in m2vkt1ea
• Lenovo Ideacentre 3 07Ach7 Firmware: before m4mkt12a — fixed in m4mkt12a
• Lenovo Ideacentre 3 07Iab7 Firmware: before m49kt21a — fixed in m49kt21a
• Lenovo Ideacentre 5-14Acn6 Firmware: before o5ekt24a — fixed in o5ekt24a
• Lenovo Ideacentre 5-14Are05 Firmware: before o4zkt2aa — fixed in o4zkt2aa
• Lenovo Ideacentre 5-14Imb05 Firmware: before o4hkt3aa — fixed in o4hkt3aa
• Lenovo Ideacentre 5-14Iob6 Firmware: before m3gkt3aa — fixed in m3gkt3aa
• Lenovo Ideacentre 510S-07Icb Firmware: before m22kt49a — fixed in m22kt49a
• Lenovo Ideacentre 510S-07Ick Firmware: before m30kt28a; before m1zkt40a — fixed in m1zkt40a, m30kt28a
• Lenovo Ideacentre 5 14Iab7 Firmware: before m42kt42a — fixed in m42kt42a
• Lenovo Ideacentre 720-18Apr Firmware: before m25kt63a — fixed in m25kt63a
• Lenovo Ideacentre Aio 3-22Imb05 Firmware: before o5nkt32a — fixed in o5nkt32a
• Lenovo Ideacentre Aio 3-22Itl6 Firmware: before o5akt33 — fixed in o5akt33
• Lenovo Ideacentre Aio 3-24Alc6 Firmware: before o5bkt25a — fixed in o5bkt25a
• Lenovo Ideacentre Aio 3-24Imb05 Firmware: before o5nkt32a — fixed in o5nkt32a
• Lenovo Ideacentre Aio 3-24Itl6 Firmware: before o5akt33 — fixed in o5akt33
• Lenovo Ideacentre Aio 3-27Alc6 Firmware: before o5bkt25a — fixed in o5bkt25a
• Lenovo Ideacentre Aio 3-27Imb05 Firmware: before o5nkt32a — fixed in o5nkt32a
• Lenovo Ideacentre Aio 3-27Itl6 Firmware: before o5akt33 — fixed in o5akt33
• Lenovo Ideacentre Aio 3 21Itl7 Firmware: before o5akt33 — fixed in o5akt33
• Lenovo Ideacentre Aio 3 22Iap7 Firmware: before o5nkt32a — fixed in o5nkt32a
• Lenovo Ideacentre Aio 3 24Iap7 Firmware: before o5nkt32a — fixed in o5nkt32a
• Lenovo Ideacentre Aio 3 27Iap7 Firmware: before o5nkt32a — fixed in o5nkt32a
• Lenovo Ideacentre Aio 5 24Iah7 Firmware: before o5rkt39a — fixed in o5rkt39a
• Lenovo Ideacentre Aio 5 27Iah7 Firmware: before o5rkt39a — fixed in o5rkt39a
• Lenovo Ideacentre C5-14Imb05 Firmware: before o4hkt3aa — fixed in o4hkt3aa
• Lenovo Ideacentre Creator 5-14Iob6 Firmware: before m3gkt3aa — fixed in m3gkt3aa
• Lenovo Ideacentre G5-14Amr05 Firmware: before o4zkt2aa — fixed in o4zkt2aa
• Lenovo Ideacentre G5-14Imb05 Firmware: before o4hkt3aa — fixed in o4hkt3aa

How to fix

Upgrade to a fixed version: Lenovo Ideacentre 3-07Ada05 Firmware m4mkt12a, o4fkt35a; Lenovo Ideacentre 3-07Imb05 Firmware m2vkt1ea; Lenovo Ideacentre 3 07Ach7 Firmware m4mkt12a; Lenovo Ideacentre 3 07Iab7 Firmware m49kt21a; Lenovo Ideacentre 5-14Acn6 Firmware o5ekt24a; Lenovo Ideacentre 5-14Are05 Firmware o4zkt2aa; Lenovo Ideacentre 5-14Imb05 Firmware o4hkt3aa; Lenovo Ideacentre 5-14Iob6 Firmware m3gkt3aa; Lenovo Ideacentre 510S-07Icb Firmware m22kt49a; Lenovo Ideacentre 510S-07Ick Firmware m1zkt40a, m30kt28a; Lenovo Ideacentre 5 14Iab7 Firmware m42kt42a; Lenovo Ideacentre 720-18Apr Firmware m25kt63a. Check the vendor advisory for mitigations.

References

• https://support.lenovo.com/us/en/product_security/LEN-124495
• https://support.lenovo.com/us/en/product_security/LEN-124495

Get alerted when CVE-2022-48181 or the next vulnerability affects your stack