CVE-2022-48188

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-06-05 · updated 2026-06-17
Weakness: CWE-787

Description

A buffer overflow vulnerability in the SecureBootDXE BIOS driver of some Lenovo Desktop and ThinkStation models could allow an attacker with local access to elevate their privileges to execute arbitrary code.

Affected products

Lenovo Ideacentre 510S-07Icb Firmware: before m22kt48a; before m22kt49a — fixed in m22kt48a, m22kt49a
Lenovo Ideacentre 510S-07Ick Firmware: before m30kt28a; before m1zkt40a — fixed in m1zkt40a, m30kt28a
Lenovo Ideacentre 720-18Apr Firmware: before m25kt63a — fixed in m25kt63a
Lenovo Ideacentre Aio 3-22Itl6 Firmware: before o5akt33 — fixed in o5akt33
Lenovo Ideacentre Aio 3-24Itl6 Firmware: before o5akt33 — fixed in o5akt33
Lenovo Ideacentre Aio 3-27Itl6 Firmware: before o5akt33 — fixed in o5akt33
Lenovo Ideacentre Aio 3 21Itl7 Firmware: before o5akt33 — fixed in o5akt33
Lenovo Thinkcentre M720E Firmware: before m1zkt40a — fixed in m1zkt40a
Lenovo Thinkcentre M720Q Firmware: before m1ukt70a — fixed in m1ukt70a
Lenovo Thinkcentre M720S Firmware: before m1ukt70a — fixed in m1ukt70a
Lenovo Thinkcentre M720T Firmware: before m1ukt70a — fixed in m1ukt70a
Lenovo Thinkcentre M725S Firmware: before m25kt63a — fixed in m25kt63a
Lenovo Thinkcentre M75S Gen 2 Firmware: before m46kt30a; before m3bkt30a — fixed in m3bkt30a, m46kt30a
Lenovo Thinkcentre M75T Gen 2 Firmware: before m46kt30a; before m3akt4ca — fixed in m3akt4ca, m46kt30a
Lenovo Thinkcentre M920Q Firmware: before m1ukt70a — fixed in m1ukt70a
Lenovo Thinkcentre M920S Firmware: before m1ukt70a — fixed in m1ukt70a
Lenovo Thinkcentre M920T Firmware: before m1ukt70a — fixed in m1ukt70a
Lenovo Thinkcentre M920X Firmware: before m1ukt70a — fixed in m1ukt70a
Lenovo Thinkcentre M920Z Firmware: before m1mkt55a — fixed in m1mkt55a
Lenovo Thinkstation P330 Tiny Firmware: before m1ukt70a — fixed in m1ukt70a
Lenovo Thinkstation P360 Ultra Firmware: before s0fkt27a — fixed in s0fkt27a
Lenovo Thinkstation P520 Firmware: before s03kt58a — fixed in s03kt58a
Lenovo Thinkstation P520C Firmware: before s03kt58a — fixed in s03kt58a
Lenovo V30A-22Itl Firmware: before o5akt33 — fixed in o5akt33
Lenovo V30A-24Itl Firmware: before o5akt33 — fixed in o5akt33
Lenovo V530S-07Icb Firmware: before m22kt49a — fixed in m22kt49a
Lenovo V530S-07Icr Firmware: before m1zkt40a — fixed in m1zkt40a

How to fix

Upgrade to a fixed version: Lenovo Ideacentre 510S-07Icb Firmware m22kt48a, m22kt49a; Lenovo Ideacentre 510S-07Ick Firmware m1zkt40a, m30kt28a; Lenovo Ideacentre 720-18Apr Firmware m25kt63a; Lenovo Ideacentre Aio 3-22Itl6 Firmware o5akt33; Lenovo Ideacentre Aio 3-24Itl6 Firmware o5akt33; Lenovo Ideacentre Aio 3-27Itl6 Firmware o5akt33; Lenovo Ideacentre Aio 3 21Itl7 Firmware o5akt33; Lenovo Thinkcentre M720E Firmware m1zkt40a; Lenovo Thinkcentre M720Q Firmware m1ukt70a; Lenovo Thinkcentre M720S Firmware m1ukt70a; Lenovo Thinkcentre M720T Firmware m1ukt70a; Lenovo Thinkcentre M725S Firmware m25kt63a. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2022-48188 or the next vulnerability affects your stack