Thinkcentre M625Q Firmware
CVE-2023-43572
MEDIUM
Severity by source
AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
1DescriptionNVD
A buffer over-read was reported in the BiosExtensionLoader module in some Lenovo Desktop products that may allow a local attacker with elevated privileges to disclose sensitive information.
AnalysisAI
A buffer over-read was reported in the BiosExtensionLoader module in some Lenovo Desktop products that may allow a local attacker with elevated privileges to disclose sensitive information. Rated medium severity (CVSS 4.4), this vulnerability is low attack complexity. No vendor patch available.
Technical ContextAI
This vulnerability is classified under CWE-126. A buffer over-read was reported in the BiosExtensionLoader module in some Lenovo Desktop products that may allow a local attacker with elevated privileges to disclose sensitive information. Affected products include: Lenovo Ideacentre C5-14Imb05 Firmware, Lenovo Ideacentre 3-07Ada05 Firmware, Lenovo Ideacentre 3-07Imb05 Firmware, Lenovo Ideacentre 5 14Iab7 Firmware, Lenovo Ideacentre 5 14Irb8 Firmware.
RemediationAI
No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.
More in Thinkcentre M625Q Firmware
View allThe BIOS tamper detection mechanism was not triggered in Lenovo ThinkPad T460p, BIOS versions up to R07ET90W, and T470p,
A memory leakage vulnerability was reported in the NvmramSmm SMM driver that may allow a local attacker with elevated pr
A memory leakage vulnerability was reported in the DustFilterAlertSmm SMM driver that may allow a local attacker with el
A memory leakage vulnerability was reported in the 534D0740 DXE driver that may allow a local attacker with elevated pri
A memory leakage vulnerability was reported in the 534D0140 DXE driver that may allow a local attacker with elevated pri
A memory leakage vulnerability was reported in the SWSMI_Shadow DXE driver that may allow a local attacker with elevated
A buffer overflow was reported in the Update_WMI module in some Lenovo Desktop products that may allow a local attacker
A buffer overflow was reported in the SmuV11DxeVMR module in some Lenovo Desktop products that may allow a local attacke
A buffer overflow was reported in the SmuV11Dxe driver in some Lenovo Desktop products that may allow a local attacker w
A buffer overflow was reported in the SmiFlash module in some Lenovo Desktop products that may allow a local attacker wi
A buffer overflow was reported in the ReFlash module in some Lenovo Desktop products that may allow a local attacker wit
A buffer overflow was reported in the WMISwSmi module in some Lenovo Desktop products that may allow a local attacker wi
Same weakness CWE-126 – Buffer Over-read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today