CVE-2022-40137 MEDIUM

CVE-2022-40137

Vendor Lenovo

Product BIOS

Weakness CWE-120

Published January 30, 2023

Last update March 27, 2025

View on NVD All CVEs

CVSS base score

6.7/10

Attack vector Local

Attack complexity Low

Privileges required High

User interaction None

Confidentiality High

Integrity High

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

A buffer overflow in the WMI SMI Handler in some Lenovo models may allow an attacker with local access and elevated privileges to execute arbitrary code.

Key dates

02Disclosure timeline

January 30, 2023 CVE published

March 27, 2025 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2022-40137 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/120.html

Related vulnerabilities

CVE-2022-40137

01Description

02Disclosure timeline

03References

04Related CVE