Medium severity · published Aug 17, 2023
CVE-2023-34419
A buffer overflow has been identified in the SetupUtility driver in some Lenovo Notebook products which may allow an attacker with local access and elevated privileges to execute…
6.7
CVSS
0.2%
EPSS
No
On KEV
Description
A buffer overflow has been identified in the SetupUtility driver in some Lenovo Notebook products which may allow an attacker with local access and elevated privileges to execute arbitrary code.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 9% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LN
Lenovo Notebook · Lenovo
various · source: vendor
L5
Legion 5 15arh7 Firmware · Lenovo
All versions, or not specified · source: NVD
L5
Legion 5 15arh7h Firmware · Lenovo
All versions, or not specified · source: NVD
L5
Legion 5 15iah7 Firmware · Lenovo
before j2cn51ww · source: NVD
L5
Legion 5 15iah7h Firmware · Lenovo
before j2cn51ww · source: NVD
L5
Legion 5 Pro 16arh7 Firmware · Lenovo
All versions, or not specified · source: NVD
L5
Legion 5 Pro 16arh7h Firmware · Lenovo
All versions, or not specified · source: NVD
L5
Legion 5 Pro 16iah7 Firmware · Lenovo
before j2cn51ww · source: NVD
L5
Legion 5 Pro 16iah7h Firmware · Lenovo
before j2cn51ww · source: NVD
L5
Legion 5 Pro-16ach6 Firmware · Lenovo
All versions, or not specified · source: NVD
L5
Legion 5 Pro-16ach6h Firmware · Lenovo
All versions, or not specified · source: NVD
L5
Legion 5 Pro-16ith6 Firmware · Lenovo
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-34419
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-34419
Vendor Advisory
https://support.lenovo.com/us/en/product_security/LEN-134879
More from Lenovo Notebook
6.7
CVE-2023-4028
A buffer overflow has been identified in the SystemUserMasterHddPwdDxe driver in some Lenovo Notebook products which may allow an attacker with local access and elevated…