Medium severity · published Nov 8, 2023
CVE-2023-43574
A buffer over-read was reported in the LEMALLDriversConnectedEventHook module in some Lenovo Desktop products that may allow a local attacker with elevated privileges to disclose…
4.4
CVSS
0.2%
EPSS
No
On KEV
Description
A buffer over-read was reported in the LEMALLDriversConnectedEventHook module in some Lenovo Desktop products that may allow a local attacker with elevated privileges
to disclose sensitive information.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Attack vector
Local
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 13% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
I3
Ideacentre 3-07ada05 Firmware · Lenovo
before o4fkt39a · source: NVD
I3
Ideacentre 3-07imb05 Firmware · Lenovo
before m2vkt21a · source: NVD
I5
Ideacentre 5 14iab7 Firmware · Lenovo
before m42kt46a · source: NVD
I5
Ideacentre 5 14irb8 Firmware · Lenovo
before m4ukt36a · source: NVD
I5
Ideacentre 5-14acn6 Firmware · Lenovo
All versions, or not specified · source: NVD
IC
Ideacentre C5-14imb05 Firmware · Lenovo
before o4hkt3ca · source: NVD
IG
Ideacentre Gaming 5 17iab7 Firmware · Lenovo
before m42kt46a · source: NVD
IG
Ideacentre Gaming 5-14acn6 Firmware · Lenovo
All versions, or not specified · source: NVD
IG
Ideacentre Gaming 5-14iob6 Firmware · Lenovo
before m3gkt3da · source: NVD
IM
Ideacentre Mini 5 01iaq7 Firmware · Lenovo
before o53kt10a · source: NVD
IM
Ideacentre Mini 5-01imh05 Firmware · Lenovo
All versions, or not specified · source: NVD
IT
Ideacentre T540-15ama G Firmware · Lenovo
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-43574
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-43574
Vendor Advisory
https://support.lenovo.com/us/en/product_security/LEN-141775
More from Ideacentre 3-07ada05 Firmware
7.8
CVE-2022-48181
An ErrorMessage driver stack-based buffer overflow vulnerability in BIOS of some ThinkPad models could allow an attacker with local access to elevate their privileges and execute…
6.7
CVE-2023-45079
A memory leakage vulnerability was reported in the NvmramSmm SMM driver that may allow a local attacker with elevated privileges to write to NVRAM variables
6.7
CVE-2023-45078
A memory leakage vulnerability was reported in the DustFilterAlertSmm SMM driver that may allow a local attacker with elevated privileges to write to NVRAM variables
6.7
CVE-2023-45077
A memory leakage vulnerability was reported in the 534D0740 DXE driver that may allow a local attacker with elevated privileges to write to NVRAM variables
6.7
CVE-2023-45076
A memory leakage vulnerability was reported in the 534D0140 DXE driver that may allow a local attacker with elevated privileges to write to NVRAM variables