EUVD-2026-44982
GHSA-837q-rr3r-wp9q
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
WMI-to-SMI invocation crosses the OS security boundary into SMM ring -2 (scope change); PR:H required as admin OS privileges are a hard prerequisite; no confidentiality or availability impact identified per vendor data.
Primary rating from Vendor (lenovo).
CVSS VectorVendor: lenovo
Lifecycle Timeline
2DescriptionCVE.org
A potential missing authentication vulnerability could allow a local privileged attacker to use WMI commands to arbitrarily trigger a System Management Interrupt handler.
AnalysisAI
Lenovo BIOS firmware across dozens of consumer and gaming laptop models - Legion, IdeaPad, Yoga, ThinkBook, LOQ, and V-series - contains a missing authentication flaw in the WMI-to-SMI interface that permits a local privileged attacker to arbitrarily trigger System Management Interrupt handlers, enabling execution at the SMM firmware level below the operating system security boundary. No public exploit code has been identified at time of analysis, and CISA KEV listing is not confirmed. The practical threat is post-compromise firmware persistence: an attacker already holding OS-level administrative privileges could use this flaw to manipulate firmware behavior in ways invisible to endpoint security tools, bypassing Secure Boot or implanting persistent code in System Management Mode.
Technical ContextAI
WMI (Windows Management Instrumentation) is a Windows OS framework for system management tasks; in Lenovo's BIOS implementation, specific WMI commands can invoke SMI (System Management Interrupt) handlers - firmware routines that execute in System Management Mode (SMM), an x86/x64 execution environment at privilege ring -2, entirely below the hypervisor and operating system. The vulnerability is the absence of authentication at the boundary between the WMI command layer and BIOS SMI handler invocation, allowing a caller with sufficient OS privileges to trigger SMI handlers without presenting BIOS-level credentials. No CWE is formally assigned, but the vendor tag 'Authentication Bypass' and the description phrase 'missing authentication' align with CWE-306 (Missing Authentication for Critical Function). CPE strings confirm the scope spans more than ten explicitly named Lenovo laptop BIOS firmware images across AMD (AGP, ARP, AMN, AFR, ADR suffixes) and Intel (IPH, IAH, IRX, IAX, IMH suffixes) platforms within the Yoga Pro, IdeaPad Pro, Legion, Legion Pro, LOQ, Yoga Book, ThinkBook, and V-series product families.
RemediationAI
The primary fix is to apply updated BIOS firmware for each affected Lenovo model as specified in Lenovo security advisory LEN-220440, available at https://support.lenovo.com/us/en/product_security/LEN-220440; exact patched version numbers per model must be retrieved directly from that advisory as they are not derivable from the available input data. BIOS updates can be deployed via Lenovo Vantage (consumer), Lenovo Commercial Vantage or System Update (enterprise), or SCCM/MECM using Lenovo update packages. As a compensating control while awaiting BIOS update deployment, restrict local privileged account membership on affected endpoints to the minimum necessary personnel and monitor for anomalous WMI activity using endpoint detection and response (EDR) tools targeting unusual BIOS-interface WMI calls; note that this control reduces attack surface but does not eliminate the underlying flaw, since the attacker already requires OS-level administrative privileges to exploit it. Restricting physical access to affected Lenovo laptops is an additional hardening measure where applicable.
More in Yoga Pro 7 15Iph11 Bios
View allOut-of-bounds write in Lenovo BIOS firmware across dozens of consumer and gaming laptop models enables a local attacker
Out-of-bounds write in Lenovo BIOS firmware across dozens of consumer and gaming laptop models enables a local privilege
SMM memory address disclosure in Lenovo laptop BIOS firmware exposes the location of protected System Management Mode (S
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today