CVE-2022-3746 MEDIUM

CVE-2022-3746

Vendor Lenovo

Product Notebook

Weakness CWE-284

Published August 23, 2023

Last update August 3, 2024

View on NVD All CVEs

CVSS base score

6.7/10

Attack vector Local

Attack complexity Low

Privileges required High

User interaction None

Confidentiality High

Integrity High

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

A potential vulnerability was discovered in LCFC BIOS for some Lenovo consumer notebook models that could allow a local attacker with elevated privileges to cause some peripherals to work abnormally due to an exposed Embedded Controller (EC) interface.

Key dates

02Disclosure timeline

August 23, 2023 CVE published

August 3, 2024 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2022-3746 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/284.html

Related vulnerabilities

04Related CVE

CVE-2021-1581 Cisco Application Policy Infrastructure Controller Command Injection and File Upload Vulnerabilities CVE-2019-15999 Cisco Data Center Network Manager JBoss EAP Unauthorized Access Vulnerability CVE-2025-24429 Adobe Commerce | Improper Access Control (CWE-284) CVE-2026-35172 Distribution has stale blob access resurrection via repo-scoped redis descriptor cache invalidation CVE-2026-44976 Frappe: IDOR in update_onboarding_step