CVE-2023-4028: A buffer overflow has been identified in the SystemUserMasterHddPwdDxe driver in some Lenovo Notebook products which may allow an attacker with local access and elevated…

Description

A buffer overflow has been identified in the SystemUserMasterHddPwdDxe driver in some Lenovo Notebook products which may allow an attacker with local access and elevated privileges to execute arbitrary code.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Attack vector

Local

Complexity

Low

Privileges

High

User interaction

None

Confidentiality

High

Integrity

High

Availability

High

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)0.2% · higher than 9% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

1Y

13w Yoga Firmware · Lenovo

before jacn38ww · source: NVD

1Y

13w Yoga Gen 2 Firmware · Lenovo

before kbcn20ww · source: NVD

F5

Flex 5-14alc05 Firmware · Lenovo

before gjcn32ww · source: NVD

F5

Flex 5-14are05 Firmware · Lenovo

before eecn43ww · source: NVD

F5

Flex 5-14iil05 Firmware · Lenovo

before eccn45ww · source: NVD

F5

Flex 5-14itl05 Firmware · Lenovo

before fxcn44ww · source: NVD

F5

Flex 5-15alc05 Firmware · Lenovo

before gjcn32ww · source: NVD

F5

Flex 5-15iil05 Firmware · Lenovo

before eccn45ww · source: NVD

F5

Flex 5-15itl05 Firmware · Lenovo

before fxcn44ww · source: NVD

F7

Flex 7 14iru8 Firmware · Lenovo

before l6cn20ww · source: NVD

I1

Ideapad 1-11ada05 Firmware · Lenovo

before fqcn29ww · source: NVD

I1

Ideapad 1-11igl05 Firmware · Lenovo

before dwcn28ww · source: NVD