CVE-2023-43573

MEDIUM

6.7

CVSS Score

Published: November 8, 2023 at 10:34 PM UTC

Updated: June 17, 2026 at 06:26 AM UTC

223 products affected across 1 vendorThinkstation P920 Workstation FirmwareThinkcentre M625Q FirmwareIdeacentre G5-14imb05 Firmware

Using Desktop BIOS by Lenovo?

Get instant alerts when new vulnerabilities affect Desktop BIOS - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

MEDIUM6.7

Exploit prediction

EPSS 0.2%

SSVC

No known exploit

Description

A buffer overflow was reported in the LEMALLDriversConnectedEventHook module in some Lenovo Desktop products that may allow a local attacker with elevated privileges to execute arbitrary code.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Ideacentre 3-07ada05 Firmware · Lenovo

95%

v < o4fkt39a

Affected range stops below o4fkt39a, so it looks safe — our inference, not a vendor statement

lenovo-ideacentre-3-07ada05 (same device)

Ideacentre 3-07imb05 Firmware · Lenovo

95%

v < m2vkt21a

Affected range stops below m2vkt21a, so it looks safe — our inference, not a vendor statement

lenovo-ideacentre-3-07imb05 (same device)

Ideacentre 5-14acn6 Firmware · Lenovo

95%

All versions

lenovo-ideacentre-5-14acn6 (same device)

Ideacentre 5 14IAB7 Firmware · Lenovo

95%

v < m42kt46a

Affected range stops below m42kt46a, so it looks safe — our inference, not a vendor statement

lenovo-ideacentre-5-14iab7 (same device)

Ideacentre 5-14imb05 Firmware · Lenovo

95%

v < o4hkt3ca

Affected range stops below o4hkt3ca, so it looks safe — our inference, not a vendor statement

lenovo-ideacentre-5-14imb05 (same device)

Ideacentre 5-14iob6 Firmware · Lenovo

95%

v < m3gkt3da

Affected range stops below m3gkt3da, so it looks safe — our inference, not a vendor statement

lenovo-ideacentre-5-14iob6 (same device)

Ideacentre 5 14IRB8 Firmware · Lenovo

95%

v < m4ukt36a

Affected range stops below m4ukt36a, so it looks safe — our inference, not a vendor statement

lenovo-ideacentre-5-14irb8 (same device)

Ideacentre Aio 3 21ITL7 Firmware · Lenovo

95%

v < o5akt34a

Affected range stops below o5akt34a, so it looks safe — our inference, not a vendor statement

lenovo-ideacentre-aio-3-21itl7 (same device)

Ideacentre Aio 3 22IAP7 Firmware · Lenovo

95%

v < o5nkt33a

Affected range stops below o5nkt33a, so it looks safe — our inference, not a vendor statement

lenovo-ideacentre-aio-3-22iap7 (same device)

Ideacentre Aio 3-22iil5 Firmware · Lenovo

95%

v < o56kt24a

Affected range stops below o56kt24a, so it looks safe — our inference, not a vendor statement

lenovo-ideacentre-aio-3-22iil5 (same device)

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

Patch and advisory references

https://support.lenovo.com/us/en/product_security/LEN-141775

References (1)

Vendor Advisory

Source: [email protected]

https://support.lenovo.com/us/en/product_security/LEN-141775

SSVC — Action Prioritization

SSVCNo known exploitNot automatableTotal impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

6.7MEDIUMlenovo

Attack Vector: LOCAL
Complexity: LOW
Privileges: HIGH
User Interaction: NONE
Scope: UNCHANGED
Confidentiality: HIGH
Integrity: HIGH
Availability: HIGH

Vector?

Quick Info

StatusMODIFIED

CWE

CWE-120

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create account Sign in

Free plan, no card