CVE-2022-48189

Severity: medium (CVSS 6.7 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-10-30 · updated 2026-06-17
Weakness: CWE-20

Description

An SMM driver input validation vulnerability in the BIOS of some ThinkPad models could allow an attacker with local access and elevated privileges to execute arbitrary code.

Affected products

Lenovo Thinkpad E14 Firmware: before 1.23 — fixed in 1.23
Lenovo Thinkpad E14 Gen 2 Firmware: before 1.55 — fixed in 1.55
Lenovo Thinkpad E14 Gen 4 Firmware: before 1.18; before 1.16 — fixed in 1.16, 1.18
Lenovo Thinkpad E15 Firmware: before 1.23 — fixed in 1.23
Lenovo Thinkpad E15 Gen 2 Firmware: before 1.55 — fixed in 1.55
Lenovo Thinkpad E15 Gen 4 Firmware: before 1.18; before 1.16 — fixed in 1.16, 1.18
Lenovo Thinkpad E490 Firmware: before 1.34 — fixed in 1.34
Lenovo Thinkpad E490S Firmware: before 1.34 — fixed in 1.34
Lenovo Thinkpad E590 Firmware: before 1.34 — fixed in 1.34
Lenovo Thinkpad L13 Gen 3 Firmware: before 1.14 — fixed in 1.14
Lenovo Thinkpad L13 Yoga Gen 3 Firmware: before 1.14 — fixed in 1.14
Lenovo Thinkpad L14 Firmware: before 1.2; before 1.3; before 1.26 — fixed in 1.2, 1.26, 1.3
Lenovo Thinkpad L15 Firmware: before 1.2; before 1.3 — fixed in 1.2, 1.3
Lenovo Thinkpad L15 Gen 2 Firmware: all versions
Lenovo Thinkpad L15 Gen 3 Firmware: before 1.26 — fixed in 1.26
Lenovo Thinkpad L490 Firmware: before 1.32 — fixed in 1.32
Lenovo Thinkpad L590 Firmware: before 1.32 — fixed in 1.32
Lenovo Thinkpad P14S Gen 1 Firmware: before 1.28 — fixed in 1.28
Lenovo Thinkpad P14S Gen 2 Firmware: before 1.34 — fixed in 1.34
Lenovo Thinkpad P14S Gen 3 Firmware: all versions
Lenovo Thinkpad P15 Gen 1 Firmware: before 1.32 — fixed in 1.32
Lenovo Thinkpad P15 Gen 2 Firmware: before 1.25 — fixed in 1.25
Lenovo Thinkpad P15S Gen 1 Firmware: before 1.28 — fixed in 1.28
Lenovo Thinkpad P15S Gen 2 Firmware: all versions
Lenovo Thinkpad P15V Gen 1 Firmware: before 1.32 — fixed in 1.32
Lenovo Thinkpad P15V Gen 2 Firmware: before 1.19 — fixed in 1.19
Lenovo Thinkpad P15V Gen 3 Firmware: before 1.15 — fixed in 1.15
Lenovo Thinkpad P16 Gen 1 Firmware: before 1.17 — fixed in 1.17
Lenovo Thinkpad P16S Gen 1 Firmware: all versions
Lenovo Thinkpad P17 Gen 1 Firmware: before 1.32 — fixed in 1.32

How to fix

Upgrade to a fixed version: Lenovo Thinkpad E14 Firmware 1.23; Lenovo Thinkpad E14 Gen 2 Firmware 1.55; Lenovo Thinkpad E14 Gen 4 Firmware 1.16, 1.18; Lenovo Thinkpad E15 Firmware 1.23; Lenovo Thinkpad E15 Gen 2 Firmware 1.55; Lenovo Thinkpad E15 Gen 4 Firmware 1.16, 1.18; Lenovo Thinkpad E490 Firmware 1.34; Lenovo Thinkpad E490S Firmware 1.34; Lenovo Thinkpad E590 Firmware 1.34; Lenovo Thinkpad L13 Gen 3 Firmware 1.14; Lenovo Thinkpad L13 Yoga Gen 3 Firmware 1.14; Lenovo Thinkpad L14 Firmware 1.2, 1.26, 1.3. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2022-48189 or the next vulnerability affects your stack