CVE-2023-45077

moderate-risk

Published 2023-11-08

A memory leakage vulnerability was reported in the 534D0740 DXE driver that may allow a local attacker with elevated privileges to write to NVRAM variables.

Do I need to act?

0.03% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 6.7/10 Medium

LOCAL / LOW complexity

Affected Products (20)

Ideacentre C5-14Imb05 Firmware

Ideacentre 3-07Ada05 Firmware

Ideacentre 3-07Imb05 Firmware

Ideacentre G5-14Imb05 Firmware

Ideacentre 5-14Iob6 Firmware

Ideacentre Creator 5-14Iob6 Firmware

Ideacentre G5-14Amr05 Firmware

Ideacentre Gaming 5-14Iob6 Firmware

Ideacentre Mini 5 01Iaq7 Firmware

Ideacentre Mini 5-01Imh05 Firmware

Legion T7-34Imz5 Firmware

Thinkcentre M625Q Firmware

Thinkcentre M630E Firmware

Thinkcentre M70A Firmware

Thinkcentre M920Z All-In-One Firmware

Thinkcentre M920X Firmware

Thinkcentre M920T Firmware

Thinkcentre M920S Firmware

Thinkcentre M920Q Firmware

Thinkcentre M90T Firmware

Affected Vendors

Lenovo

References (2)

Vendor Advisory https://support.lenovo.com/us/en/product_security/LEN-141775

/ 100

moderate-risk

Severity 21/34 · High

Exploitability 0/34 · Minimal

Exposure 27/34 · High