Skip to content
Fencer Intel
medium 6.7

CVE-2022-3431 json

A potential vulnerability in a driver used during manufacturing process on some consumer Lenovo Notebook devices that was mistakenly not de…

published 3y ago modified 4mo ago also EUVD-2022-42807

cvss
6.7
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.2%
EPSS 0.2% chance of exploitation in 30 days, percentile 10%
public exploits
0
none known

Summary

A potential vulnerability in a driver used during manufacturing process on some consumer Lenovo Notebook devices that was mistakenly not deactivated may allow an attacker with elevated privileges to modify secure boot setting by modifying an NVRAM variable.

Patch / fix

  • lenovo ideapad_creator_5-16ach6_firmware gscn34ww
  • lenovo ideapad_5_pro-16ihu6_firmware grcn22ww
  • lenovo ideapad_5_pro-16ach6_firmware gscn34ww
  • lenovo yoga_slim_7-13itl05_firmware f7cn39ww
  • lenovo yoga_slim_7-13acn05_firmware ghcn28ww
  • lenovo yoga_slim_7_pro_16arh7_firmware klcn15ww
  • lenovo yoga_slim_7_pro_16ach6_firmware hucn16ww
  • lenovo yoga_slim_7_carbon_13itl5_firmware f7cn39ww
  • lenovo yoga_duet_7-13itl6-lte_firmware gpcn24ww
  • lenovo yoga_duet_7-13itl6_firmware gpcn24ww
  • lenovo yoga_duet_7-13iml05_firmware ercn30ww
  • lenovo thinkbook_plus_g3_iap_firmware k6cn29ww
  • lenovo thinkbook_plus_g2_itg_firmware gycn31ww
  • lenovo thinkbook_16p_nx_arh_firmware kjcn27ww
  • lenovo thinkbook_16_g4+_iap_firmware hycn40ww
  • lenovo thinkbook_16_g4+_ara_firmware j6cn40ww
  • lenovo thinkbook_14_g4+_iap_firmware hycn40ww
  • lenovo thinkbook_14_g4+_ara_firmware j6cn40ww
  • lenovo thinkbook_13x_itg_firmware hlcn30ww
  • lenovo ideapad_slim_7_pro_16ach6_firmware hucn16ww

Is CVE-2022-3431 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
2y ago

Exploit prediction

0.21% chance of exploitation in the next 30 days, higher than 10% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
CNA 3.1 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
NVD 3.1 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

  • Lenovo BIOS
  • lenovo notebook

Classification

Weakness
  • CWE-276 Incorrect Default Permissions

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.