What’s Vulnerable › Vulnerabilities

CVE-2023-34419

• Severity: medium (CVSS 6.7 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-08-17 · updated 2026-06-17
• Weakness: CWE-120

Description

A buffer overflow has been identified in the SetupUtility driver in some Lenovo Notebook products which may allow an attacker with local access and elevated privileges to execute arbitrary code.

Affected products

• Lenovo Legion 5-15Ach6 Firmware: all versions
• Lenovo Legion 5-15Ach6A Firmware: all versions
• Lenovo Legion 5-15Ach6H Firmware: all versions
• Lenovo Legion 5-15Ith6 Firmware: all versions
• Lenovo Legion 5-15Ith6H Firmware: all versions
• Lenovo Legion 5-17Ach6 Firmware: all versions
• Lenovo Legion 5-17Ach6H Firmware: all versions
• Lenovo Legion 5-17Ith6 Firmware: all versions
• Lenovo Legion 5-17Ith6H Firmware: all versions
• Lenovo Legion 5 15Arh7 Firmware: all versions
• Lenovo Legion 5 15Arh7H Firmware: all versions
• Lenovo Legion 5 15Iah7 Firmware: before j2cn51ww — fixed in j2cn51ww
• Lenovo Legion 5 15Iah7H Firmware: before j2cn51ww — fixed in j2cn51ww
• Lenovo Legion 5 Pro-16Ach6 Firmware: all versions
• Lenovo Legion 5 Pro-16Ach6H Firmware: all versions
• Lenovo Legion 5 Pro-16Ith6 Firmware: all versions
• Lenovo Legion 5 Pro-16Ith6H Firmware: all versions
• Lenovo Legion 5 Pro 16Arh7 Firmware: all versions
• Lenovo Legion 5 Pro 16Arh7H Firmware: all versions
• Lenovo Legion 5 Pro 16Iah7 Firmware: before j2cn51ww — fixed in j2cn51ww
• Lenovo Legion 5 Pro 16Iah7H Firmware: before j2cn51ww — fixed in j2cn51ww
• Lenovo Legion 7-16Achg6 Firmware: all versions
• Lenovo Legion 7-16Arha7 Firmware: all versions
• Lenovo Legion 7-16Ithg6 Firmware: all versions
• Lenovo Legion Pro 5 16Irx8 Firmware: before kwcn37ww — fixed in kwcn37ww
• Lenovo Legion Pro 7 16Irx8 Firmware: before kwcn37ww — fixed in kwcn37ww
• Lenovo Legion Pro 7 16Irx8H Firmware: before kwcn37ww — fixed in kwcn37ww
• Lenovo Legion S7 16Arha7 Firmware: all versions
• Lenovo Thinkbook 15P G2 Ith Firmware: all versions
• Lenovo Thinkbook 16P G3 Arh Firmware: all versions

How to fix

Upgrade to a fixed version: Lenovo Legion 5 15Iah7 Firmware j2cn51ww; Lenovo Legion 5 15Iah7H Firmware j2cn51ww; Lenovo Legion 5 Pro 16Iah7 Firmware j2cn51ww; Lenovo Legion 5 Pro 16Iah7H Firmware j2cn51ww; Lenovo Legion Pro 5 16Irx8 Firmware kwcn37ww; Lenovo Legion Pro 7 16Irx8 Firmware kwcn37ww; Lenovo Legion Pro 7 16Irx8H Firmware kwcn37ww. Check the vendor advisory for mitigations.

References

• https://support.lenovo.com/us/en/product_security/LEN-134879
• https://support.lenovo.com/us/en/product_security/LEN-134879

Get alerted when CVE-2023-34419 or the next vulnerability affects your stack