CVE-2022-40135 MEDIUM

CVE-2022-40135

Vendor Lenovo

Product BIOS

Weakness CWE-125

Published January 30, 2023

Last update March 27, 2025

View on NVD All CVEs

CVSS base score

4.4/10

Attack vector Local

Attack complexity Low

Privileges required High

User interaction None

Confidentiality High

Integrity None

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

What the vulnerability does

01Description

An information leak vulnerability in the Smart USB Protection SMI Handler in some Lenovo models may allow an attacker with local access and elevated privileges to read SMM memory.

Key dates

02Disclosure timeline

January 30, 2023 CVE published

March 27, 2025 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2022-40135 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/125.html

Related vulnerabilities

CVE-2022-40135

01Description

02Disclosure timeline

03References

04Related CVE