Improper input validation in Lenovo ThinkPad BIOS
Priority LOW 29CWE-20Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- High
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Privilege escalation
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-269.
Summary
During an internal product security audit a potential vulnerability due to use of Boot Services in the SmmOEMInt15 SMI handler was discovered in some ThinkPad models could be exploited by an attacker with elevated privileges that could allow for execution of code.
Why it matters now
EPSS 0.00269 19th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Lenovo | ThinkPad BIOS | various | — | No fix listed | CNA |
- ThinkPad BIOS VendorLenovo Affected various Fixed in — No fix listed CNA
CPE configurations NVD · 60
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:lenovo:thinkpad_11e_firmware:*:*:*:*:*:*:*:* | before n15et78w | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:thinkpad_11e:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:o:lenovo:thinkpad_helix_firmware:*:*:*:*:*:*:*:* | before n17eta8w | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:thinkpad_helix:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:o:lenovo:thinkpad_l560_firmware:*:*:*:*:*:*:*:* | before n1het85w | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:thinkpad_l560:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:o:lenovo:thinkpad_l570_firmware:*:*:*:*:*:*:*:* | before n1xet65w | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:thinkpad_l570:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:o:lenovo:thinkpad_p50s_firmware:*:*:*:*:*:*:*:* | before n1ket46w | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:thinkpad_p50s:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
- cpe:2.3:o:lenovo:thinkpad_11e_firmware:*:*:*:*:*:*:*:* Versions before n15et78w Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:thinkpad_11e:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:o:lenovo:thinkpad_helix_firmware:*:*:*:*:*:*:*:* Versions before n17eta8w Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:thinkpad_helix:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:o:lenovo:thinkpad_l560_firmware:*:*:*:*:*:*:*:* Versions before n1het85w Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:thinkpad_l560:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:o:lenovo:thinkpad_l570_firmware:*:*:*:*:*:*:*:* Versions before n1xet65w Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:thinkpad_l570:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:o:lenovo:thinkpad_p50s_firmware:*:*:*:*:*:*:*:* Versions before n1ket46w Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:thinkpad_p50s:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
Show 50 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:lenovo:thinkpad_p51s_firmware:*:*:*:*:*:*:*:* | before n1vet50w | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:thinkpad_p51s:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:o:lenovo:thinkpad_p52s_firmware:*:*:*:*:*:*:*:* | before n27et36w | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:thinkpad_p52s:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:o:lenovo:thinkpad_s540_firmware:*:*:*:*:*:*:*:* | before gpet80ww | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:thinkpad_s540:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:o:lenovo:thinkpad_t550_firmware:*:*:*:*:*:*:*:* | before n11et50w | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:thinkpad_t550:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:o:lenovo:thinkpad_t560_firmware:*:*:*:*:*:*:*:* | before n1ket46w | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:thinkpad_t560:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:o:lenovo:thinkpad_t570_firmware:*:*:*:*:*:*:*:* | before n1vet50w | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:thinkpad_t570:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:o:lenovo:thinkpad_t580_firmware:*:*:*:*:*:*:*:* | before n27et36w | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:thinkpad_t580:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:o:lenovo:thinkpad_x1_tablet_gen_1_firmware:*:*:*:*:*:*:*:* | before n1let86w | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:thinkpad_x1_tablet_gen_1:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:o:lenovo:thinkpad_x1_tablet_gen_2_firmware:*:*:*:*:*:*:*:* | before n1oet50w | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:thinkpad_x1_tablet_gen_2:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:o:lenovo:thinkpad_w540_firmware:*:*:*:*:*:*:*:* | before gnet92ww | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:thinkpad_w540:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:o:lenovo:thinkpad_w541_firmware:*:*:*:*:*:*:*:* | before gnet92ww | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:thinkpad_w541:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:o:lenovo:thinkpad_w550s_firmware:*:*:*:*:*:*:*:* | before n11et50w | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:thinkpad_w550s:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:o:lenovo:thinkpad_x1_carbon_3rd_gen_firmware:*:*:*:*:*:*:*:* | before n14et52w | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:thinkpad_x1_carbon_3rd_gen:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:o:lenovo:thinkpad_x1_carbon_4th_gen_firmware:*:*:*:*:*:*:*:* | before n1fet70w | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:thinkpad_x1_carbon_4th_gen:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:o:lenovo:thinkpad_x1_carbon_5th_gen_kabylake_firmware:*:*:*:*:*:*:*:* | before n1met55w | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:thinkpad_x1_carbon_5th_gen_kabylake:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:o:lenovo:thinkpad_x1_carbon_5th_gen_skylake_firmware:*:*:*:*:*:*:*:* | before n1met55w | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:thinkpad_x1_carbon_5th_gen_skylake:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:o:lenovo:thinkpad_x1_yoga_firmware:*:*:*:*:*:*:*:* | before n1fet70w | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:thinkpad_x1_yoga:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:o:lenovo:thinkpad_x1_yoga_gen_2_firmware:*:*:*:*:*:*:*:* | before n1net47w | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:thinkpad_x1_yoga_gen_2:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:o:lenovo:thinkpad_x1_yoga_gen_3_firmware:*:*:*:*:*:*:*:* | before n25et50w | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:thinkpad_x1_yoga_gen_3:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:o:lenovo:thinkpad_x250_firmware:*:*:*:*:*:*:*:* | before n10et58w | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:thinkpad_x250:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:o:lenovo:thinkpad_x280_firmware:*:*:*:*:*:*:*:* | before n20et44w | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:thinkpad_x280:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:o:lenovo:thinkpad_x390_firmware:*:*:*:*:*:*:*:* | before n2let60w | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:thinkpad_x390:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:o:lenovo:thinkpad_11e_yoga_firmware:*:*:*:*:*:*:*:* | before n15et78w | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:thinkpad_11e_yoga:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:o:lenovo:thinkpad_yoga_15_firmware:*:*:*:*:*:*:*:* | before n19et61w | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:thinkpad_yoga_15:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:o:lenovo:thinkpad_yoga_260_firmware:*:*:*:*:*:*:*:* | before n1get98w | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:thinkpad_yoga_260:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
- cpe:2.3:o:lenovo:thinkpad_p51s_firmware:*:*:*:*:*:*:*:* Versions before n1vet50w Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:thinkpad_p51s:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:o:lenovo:thinkpad_p52s_firmware:*:*:*:*:*:*:*:* Versions before n27et36w Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:thinkpad_p52s:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:o:lenovo:thinkpad_s540_firmware:*:*:*:*:*:*:*:* Versions before gpet80ww Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:thinkpad_s540:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:o:lenovo:thinkpad_t550_firmware:*:*:*:*:*:*:*:* Versions before n11et50w Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:thinkpad_t550:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:o:lenovo:thinkpad_t560_firmware:*:*:*:*:*:*:*:* Versions before n1ket46w Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:thinkpad_t560:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:o:lenovo:thinkpad_t570_firmware:*:*:*:*:*:*:*:* Versions before n1vet50w Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:thinkpad_t570:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:o:lenovo:thinkpad_t580_firmware:*:*:*:*:*:*:*:* Versions before n27et36w Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:thinkpad_t580:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:o:lenovo:thinkpad_x1_tablet_gen_1_firmware:*:*:*:*:*:*:*:* Versions before n1let86w Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:thinkpad_x1_tablet_gen_1:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:o:lenovo:thinkpad_x1_tablet_gen_2_firmware:*:*:*:*:*:*:*:* Versions before n1oet50w Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:thinkpad_x1_tablet_gen_2:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:o:lenovo:thinkpad_w540_firmware:*:*:*:*:*:*:*:* Versions before gnet92ww Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:thinkpad_w540:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:o:lenovo:thinkpad_w541_firmware:*:*:*:*:*:*:*:* Versions before gnet92ww Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:thinkpad_w541:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:o:lenovo:thinkpad_w550s_firmware:*:*:*:*:*:*:*:* Versions before n11et50w Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:thinkpad_w550s:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:o:lenovo:thinkpad_x1_carbon_3rd_gen_firmware:*:*:*:*:*:*:*:* Versions before n14et52w Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:thinkpad_x1_carbon_3rd_gen:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:o:lenovo:thinkpad_x1_carbon_4th_gen_firmware:*:*:*:*:*:*:*:* Versions before n1fet70w Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:thinkpad_x1_carbon_4th_gen:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:o:lenovo:thinkpad_x1_carbon_5th_gen_kabylake_firmware:*:*:*:*:*:*:*:* Versions before n1met55w Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:thinkpad_x1_carbon_5th_gen_kabylake:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:o:lenovo:thinkpad_x1_carbon_5th_gen_skylake_firmware:*:*:*:*:*:*:*:* Versions before n1met55w Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:thinkpad_x1_carbon_5th_gen_skylake:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:o:lenovo:thinkpad_x1_yoga_firmware:*:*:*:*:*:*:*:* Versions before n1fet70w Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:thinkpad_x1_yoga:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:o:lenovo:thinkpad_x1_yoga_gen_2_firmware:*:*:*:*:*:*:*:* Versions before n1net47w Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:thinkpad_x1_yoga_gen_2:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:o:lenovo:thinkpad_x1_yoga_gen_3_firmware:*:*:*:*:*:*:*:* Versions before n25et50w Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:thinkpad_x1_yoga_gen_3:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:o:lenovo:thinkpad_x250_firmware:*:*:*:*:*:*:*:* Versions before n10et58w Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:thinkpad_x250:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:o:lenovo:thinkpad_x280_firmware:*:*:*:*:*:*:*:* Versions before n20et44w Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:thinkpad_x280:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:o:lenovo:thinkpad_x390_firmware:*:*:*:*:*:*:*:* Versions before n2let60w Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:thinkpad_x390:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:o:lenovo:thinkpad_11e_yoga_firmware:*:*:*:*:*:*:*:* Versions before n15et78w Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:thinkpad_11e_yoga:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:o:lenovo:thinkpad_yoga_15_firmware:*:*:*:*:*:*:*:* Versions before n19et61w Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:thinkpad_yoga_15:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:o:lenovo:thinkpad_yoga_260_firmware:*:*:*:*:*:*:*:* Versions before n1get98w Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:thinkpad_yoga_260:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2022-1107
- 2026-10-03 Alias added: GHSA-qmwg-7c3h-jmrr
References
More Lenovo Thinkpad 11e Firmware vulnerabilities
- TI-2019-04387 ThinkPad T460p and T470p BIOS Tamper Mechanism CVSS 3.1CRITICAL 9.8
- TI-2019-08001 There is a vulnerability with the Dolby DAX2 API system services in which a… CVSS 3.0MEDIUM 6.5
- TI-2020-06726 A potential vulnerability in the SMI callback function used in the Legacy SD driver in… CVSS 3.1MEDIUM 6.7
- TI-2020-06723 An internal shell was included in BIOS image in some ThinkPad models that could allow escalation of privilege. CVSS 3.1MEDIUM 6.8
- TI-2019-04373 A potential vulnerability in the SMI callback function used in Legacy USB driver using… CVSS 3.1MEDIUM 6.4
- TI-2019-04371 A potential vulnerability in the SMI callback function used in the Legacy USB driver… CVSS 3.1MEDIUM 6.4
Sources
- CVE-2022-1107 · CVE Program
- CVE-2022-1107 · NVD
- FIRST EPSS
- GHSA-qmwg-7c3h-jmrr · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences