PT-2022-6630 · Lenovo · Wmi Setup Driver

Published 2022-11-10 · Updated 2023-02-23 · CVE-2022-3430

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:L/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Lenovo Notebook devices (affected versions not specified)

Description The issue is related to a potential vulnerability in the WMI Setup driver, which may allow an attacker with elevated privileges to modify secure boot settings. This can be achieved by modifying an NVRAM variable. The vulnerability is associated with errors in using standard permissions.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Incorrect Default Permissions

Weakness Enumeration

CWE-276

Related Identifiers

BDU:2023-02906

CVE-2022-3430

Affected Products

Wmi Setup Driver

References · 8

• https://osv.dev/vulnerability/CVE-2022-3430 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-3430 · Security Note
• https://bdu.fstec.ru/vul/2023-02906 · Security Note
• https://support.lenovo.com/us/en/product_security/LEN-94952 · Vendor Advisory
• https://t.me/true_secator/3685 · Telegram Post
• https://t.me/ckure/12130 · Telegram Post
• https://t.me/echeloneyes/868 · Telegram Post
• https://t.me/cibsecurity/56862 · Telegram Post