CVE-2023-5078

Severity: medium (CVSS 6.7 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-11-08 · updated 2026-06-17
Weakness: CWE-1419

Description

A vulnerability was reported in some ThinkPad BIOS that could allow a physical or local attacker with elevated privileges to tamper with BIOS firmware.

Affected products

Lenovo Thinkpad L13 Gen 2 Firmware: all versions
Lenovo Thinkpad L13 Gen 3 Firmware: before 1.19 — fixed in 1.19
Lenovo Thinkpad L13 Gen 4 Firmware: all versions
Lenovo Thinkpad L13 Yoga Gen 2 Firmware: all versions
Lenovo Thinkpad L13 Yoga Gen 3 Firmware: before 1.19 — fixed in 1.19
Lenovo Thinkpad L13 Yoga Gen 4 Firmware: all versions
Lenovo Thinkpad L14 Gen 3 Firmware: before 1.23 — fixed in 1.23
Lenovo Thinkpad L14 Gen 4 Firmware: before 1.1 — fixed in 1.1
Lenovo Thinkpad L15 Gen 3 Firmware: before 1.23 — fixed in 1.23
Lenovo Thinkpad L15 Gen 4 Firmware: before 1.1 — fixed in 1.1
Lenovo Thinkpad P14S Gen 3 Firmware: all versions
Lenovo Thinkpad P16S Gen 1 Firmware: all versions
Lenovo Thinkpad S2 Gen 8 Firmware: all versions
Lenovo Thinkpad S2 Yoga Gen 6 Firmware: all versions
Lenovo Thinkpad S2 Yoga Gen 7 Firmware: before 1.19 — fixed in 1.19
Lenovo Thinkpad S2 Yoga Gen 8 Firmware: all versions
Lenovo Thinkpad T14 Gen 3 Firmware: all versions
Lenovo Thinkpad T14S Gen 3 Firmware: all versions
Lenovo Thinkpad T16 Gen 1 Firmware: all versions
Lenovo Thinkpad X13 Gen 3 Firmware: all versions

How to fix

Upgrade to a fixed version: Lenovo Thinkpad L13 Gen 3 Firmware 1.19; Lenovo Thinkpad L13 Yoga Gen 3 Firmware 1.19; Lenovo Thinkpad L14 Gen 3 Firmware 1.23; Lenovo Thinkpad L14 Gen 4 Firmware 1.1; Lenovo Thinkpad L15 Gen 3 Firmware 1.23; Lenovo Thinkpad L15 Gen 4 Firmware 1.1; Lenovo Thinkpad S2 Yoga Gen 7 Firmware 1.19. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2023-5078 or the next vulnerability affects your stack