CVE-2022-3744
MEDIUM
6.7
CVSS Score
Published: August 23, 2023 at 07:43 PM UTC
Updated: June 17, 2026 at 05:00 AM UTC
175 products affected across 1 vendorLegion 5-15ith6 FirmwareIdeapad Gaming 3-15imh05 FirmwareLegion 5-15ith6h Firmware
Using Notebook by Lenovo?
Get instant alerts when new vulnerabilities affect Notebook - before attackers find them.
Real-time alertsTrack your software stackFree plan available
Severity
MEDIUM6.7
Exploit prediction
EPSS 0.2%
Description
A potential vulnerability was discovered in LCFC BIOS for some Lenovo consumer notebook models that could allow a local attacker with elevated privileges to unlock UEFI variables due to a hard-coded SMI handler credential.
Affected
Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.
v < jkcn34ww
Affected range stops below jkcn34ww, so it looks safe — our inference, not a vendor statement
lenovo-ideapad-1-14iau7 (same device)
v < kkcn15ww
Affected range stops below kkcn15ww, so it looks safe — our inference, not a vendor statement
lenovo-ideapad-1-14igl7 (same device)
v < htcn31ww
Affected range stops below htcn31ww, so it looks safe — our inference, not a vendor statement
lenovo-ideapad-1-14ijl7 (same device)
v < jkcn34ww
Affected range stops below jkcn34ww, so it looks safe — our inference, not a vendor statement
lenovo-ideapad-1-15iau7 (same device)
v < kkcn15ww
Affected range stops below kkcn15ww, so it looks safe — our inference, not a vendor statement
lenovo-ideapad-1-15igl7 (same device)
v < htcn31ww
Affected range stops below htcn31ww, so it looks safe — our inference, not a vendor statement
lenovo-ideapad-1-15ijl7 (same device)
v < jkcn34ww
Affected range stops below jkcn34ww, so it looks safe — our inference, not a vendor statement
lenovo-ideapad-3-14iau7 (same device)
v < dvcn28ww
Affected range stops below dvcn28ww, so it looks safe — our inference, not a vendor statement
lenovo-ideapad-3-14igl05 (same device)
v < emcn56ww
Affected range stops below emcn56ww, so it looks safe — our inference, not a vendor statement
lenovo-ideapad-3-14iil05 (same device)
v < dxcn44ww
Affected range stops below dxcn44ww, so it looks safe — our inference, not a vendor statement
lenovo-ideapad-3-14iml05 (same device)
Remediation
No guide yetNo remediation guidance has been written for this CVE yet. What the record does show:
Patch and advisory references
References (1)
Vendor Advisory
Source: [email protected]
https://support.lenovo.com/us/en/product_security/LEN-103710CVSS
6.7MEDIUMlenovo
- Attack Vector
- LOCAL
- Complexity
- LOW
- Privileges
- HIGH
- User Interaction
- NONE
- Scope
- UNCHANGED
- Confidentiality
- HIGH
- Integrity
- HIGH
- Availability
- HIGH
Vector?
Quick Info
StatusMODIFIED
CWE
CWE-798
Get alerted
Stop reading CVE feeds looking for your own stack
Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.
Free plan, no card