What’s Vulnerable › Vulnerabilities

CVE-2023-45075

• Severity: medium (CVSS 6.7 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-11-08 · updated 2026-06-17
• Weakness: CWE-125

Description

A memory leakage vulnerability was reported in the SWSMI_Shadow DXE driver that may allow a local attacker with elevated privileges to write to NVRAM variables.

Affected products

• Lenovo Ideacentre 3-07Ada05 Firmware: before o4fkt39a — fixed in o4fkt39a
• Lenovo Ideacentre 3-07Imb05 Firmware: before m2vkt21a — fixed in m2vkt21a
• Lenovo Ideacentre 5-14Iob6 Firmware: before m3gkt3da — fixed in m3gkt3da
• Lenovo Ideacentre C5-14Imb05 Firmware: before o4hkt3ca — fixed in o4hkt3ca
• Lenovo Ideacentre Creator 5-14Iob6 Firmware: before m3gkt3da — fixed in m3gkt3da
• Lenovo Ideacentre G5-14Amr05 Firmware: before o4zkt2ba — fixed in o4zkt2ba
• Lenovo Ideacentre G5-14Imb05 Firmware: before o4hkt3ca — fixed in o4hkt3ca
• Lenovo Ideacentre Gaming 5-14Iob6 Firmware: before m3gkt3da — fixed in m3gkt3da
• Lenovo Ideacentre Mini 5-01Imh05 Firmware: before o4ekt1ba — fixed in o4ekt1ba
• Lenovo Ideacentre Mini 5 01Iaq7 Firmware: before o53kt10a — fixed in o53kt10a
• Lenovo Legion T7-34Imz5 Firmware: before o5fkt17a — fixed in o5fkt17a
• Lenovo Thinkcentre M625Q Firmware: before m1wkt52a — fixed in m1wkt52a
• Lenovo Thinkcentre M630E Firmware: all versions
• Lenovo Thinkcentre M70A Firmware: before m2skt29a — fixed in m2skt29a
• Lenovo Thinkcentre M70C Firmware: before m2vkt21a — fixed in m2vkt21a
• Lenovo Thinkcentre M70Q Firmware: before m2wkt5aa — fixed in m2wkt5aa
• Lenovo Thinkcentre M70S Firmware: before m2tkt55a — fixed in m2tkt55a
• Lenovo Thinkcentre M70T Firmware: before m2tkt55a — fixed in m2tkt55a
• Lenovo Thinkcentre M720Q Firmware: before m1ukt72a — fixed in m1ukt72a
• Lenovo Thinkcentre M720S Firmware: before m1ukt72a — fixed in m1ukt72a
• Lenovo Thinkcentre M720T Firmware: before m1ukt72a — fixed in m1ukt72a
• Lenovo Thinkcentre M75N Firmware: before m33kt27a — fixed in m33kt27a
• Lenovo Thinkcentre M75Q Gen 2 Firmware: before m47kt30a — fixed in m47kt30a
• Lenovo Thinkcentre M75S Gen 2 Firmware: all versions
• Lenovo Thinkcentre M75T Gen 2 Firmware: all versions
• Lenovo Thinkcentre M80Q Firmware: before m2wkt5aa — fixed in m2wkt5aa
• Lenovo Thinkcentre M80S Firmware: before m2tkt55a — fixed in m2tkt55a
• Lenovo Thinkcentre M80T Firmware: before m2tkt55a — fixed in m2tkt55a
• Lenovo Thinkcentre M820Z All-In-One Firmware: before m1nkt62a — fixed in m1nkt62a
• Lenovo Thinkcentre M90A Firmware: before m2rkt57a — fixed in m2rkt57a

How to fix

Upgrade to a fixed version: Lenovo Ideacentre 3-07Ada05 Firmware o4fkt39a; Lenovo Ideacentre 3-07Imb05 Firmware m2vkt21a; Lenovo Ideacentre 5-14Iob6 Firmware m3gkt3da; Lenovo Ideacentre C5-14Imb05 Firmware o4hkt3ca; Lenovo Ideacentre Creator 5-14Iob6 Firmware m3gkt3da; Lenovo Ideacentre G5-14Amr05 Firmware o4zkt2ba; Lenovo Ideacentre G5-14Imb05 Firmware o4hkt3ca; Lenovo Ideacentre Gaming 5-14Iob6 Firmware m3gkt3da; Lenovo Ideacentre Mini 5-01Imh05 Firmware o4ekt1ba; Lenovo Ideacentre Mini 5 01Iaq7 Firmware o53kt10a; Lenovo Legion T7-34Imz5 Firmware o5fkt17a; Lenovo Thinkcentre M625Q Firmware m1wkt52a. Check the vendor advisory for mitigations.

References

• https://support.lenovo.com/us/en/product_security/LEN-141775
• https://support.lenovo.com/us/en/product_security/LEN-141775

Get alerted when CVE-2023-45075 or the next vulnerability affects your stack