CVE-2023-43576

Severity: medium (CVSS 6.7 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-11-08 · updated 2026-06-17
Weakness: CWE-120

Description

A buffer overflow was reported in the WMISwSmi module in some Lenovo Desktop products that may allow a local attacker with elevated privileges to execute arbitrary code.

Affected products

Lenovo Ideacentre 3-07Ada05 Firmware: before o4fkt39a — fixed in o4fkt39a
Lenovo Ideacentre 3-07Imb05 Firmware: before m2vkt21a — fixed in m2vkt21a
Lenovo Ideacentre 5-14Acn6 Firmware: all versions
Lenovo Ideacentre 5-14Imb05 Firmware: before o4hkt3ca — fixed in o4hkt3ca
Lenovo Ideacentre 5-14Iob6 Firmware: before m3gkt3da — fixed in m3gkt3da
Lenovo Ideacentre 5 14Iab7 Firmware: before m42kt46a — fixed in m42kt46a
Lenovo Ideacentre 5 14Irb8 Firmware: before m4ukt36a — fixed in m4ukt36a
Lenovo Ideacentre Aio 3-22Iil5 Firmware: before o56kt24a — fixed in o56kt24a
Lenovo Ideacentre Aio 3-22Imb05 Firmware: before o4rkt31a — fixed in o4rkt31a
Lenovo Ideacentre Aio 3-22Itl6 Firmware: before o5akt34a — fixed in o5akt34a
Lenovo Ideacentre Aio 3-24Alc6 Firmware: before o5bkt25a — fixed in o5bkt25a
Lenovo Ideacentre Aio 3-24Iil5 Firmware: before o56kt24a — fixed in o56kt24a
Lenovo Ideacentre Aio 3-24Imb05 Firmware: before o4rkt31a — fixed in o4rkt31a
Lenovo Ideacentre Aio 3-24Itl6 Firmware: before o5akt34a — fixed in o5akt34a
Lenovo Ideacentre Aio 3-27Imb05 Firmware: before o4rkt31a — fixed in o4rkt31a
Lenovo Ideacentre Aio 3-27Itl6 Firmware: before o5akt34a — fixed in o5akt34a
Lenovo Ideacentre Aio 3 21Itl7 Firmware: before o5akt34a — fixed in o5akt34a
Lenovo Ideacentre Aio 3 22Iap7 Firmware: before o5nkt33a — fixed in o5nkt33a
Lenovo Ideacentre Aio 3 24Iap7 Firmware: before o5nkt33a — fixed in o5nkt33a
Lenovo Ideacentre Aio 3 27Iap7 Firmware: before o5nkt33a — fixed in o5nkt33a
Lenovo Ideacentre Aio 5 24Iah7 Firmware: before o5rkt41a — fixed in o5rkt41a
Lenovo Ideacentre Aio 5 27Iah7 Firmware: before o5rkt41a — fixed in o5rkt41a
Lenovo Ideacentre C5-14Imb05 Firmware: before o4hkt3ca — fixed in o4hkt3ca
Lenovo Ideacentre Creator 5-14Iob6 Firmware: before m3gkt3da — fixed in m3gkt3da
Lenovo Ideacentre G5-14Amr05 Firmware: before o4zkt2ba — fixed in o4zkt2ba
Lenovo Ideacentre G5-14Imb05 Firmware: before o4hkt3ca — fixed in o4hkt3ca
Lenovo Ideacentre Gaming 5-14Acn6 Firmware: all versions
Lenovo Ideacentre Gaming 5-14Iob6 Firmware: before m3gkt3da — fixed in m3gkt3da
Lenovo Ideacentre Gaming 5 17Acn7 Firmware: all versions
Lenovo Ideacentre Gaming 5 17Iab7 Firmware: before m42kt46a — fixed in m42kt46a

How to fix

Upgrade to a fixed version: Lenovo Ideacentre 3-07Ada05 Firmware o4fkt39a; Lenovo Ideacentre 3-07Imb05 Firmware m2vkt21a; Lenovo Ideacentre 5-14Imb05 Firmware o4hkt3ca; Lenovo Ideacentre 5-14Iob6 Firmware m3gkt3da; Lenovo Ideacentre 5 14Iab7 Firmware m42kt46a; Lenovo Ideacentre 5 14Irb8 Firmware m4ukt36a; Lenovo Ideacentre Aio 3-22Iil5 Firmware o56kt24a; Lenovo Ideacentre Aio 3-22Imb05 Firmware o4rkt31a; Lenovo Ideacentre Aio 3-22Itl6 Firmware o5akt34a; Lenovo Ideacentre Aio 3-24Alc6 Firmware o5bkt25a; Lenovo Ideacentre Aio 3-24Iil5 Firmware o56kt24a; Lenovo Ideacentre Aio 3-24Imb05 Firmware o4rkt31a. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2023-43576 or the next vulnerability affects your stack