CVE-2022-3743
MEDIUMCVSS 4.4/10EPSS 0.18%
Last modified
CVE-2022-3743 is a medium-severity vulnerability rated 4.4/10 on the CVSS scale. A potential vulnerability was discovered in LCFC BIOS for some Lenovo consumer notebook models that could allow a local attacker with elevated privileges under certain conditions the ability to enumerate Embedded Controller (EC) commands.. EPSS estimates a 0.18% chance of exploitation in the next 30 days.
Description
A potential vulnerability was discovered in LCFC BIOS for some Lenovo consumer notebook models that could allow a local attacker with elevated privileges under certain conditions the ability to enumerate Embedded Controller (EC) commands.
Metrics
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Lenovo | Ideapad 1 14iau7 Firmware | < jkcn34ww |
| Lenovo | Ideapad 1 14igl7 Firmware | < kkcn15ww |
| Lenovo | Ideapad 1 15iau7 Firmware | < jkcn34ww |
| Lenovo | Ideapad 1 15igl7 Firmware | < kkcn15ww |
| Lenovo | Ideapad 1-14ijl7 Firmware | < htcn31ww |
| Lenovo | Ideapad 1-15ijl7 Firmware | < htcn31ww |
| Lenovo | Ideapad 3 14iau7 Firmware | < jkcn34ww |
| Lenovo | Ideapad 3 15iau7 Firmware | < jkcn34ww |
| Lenovo | Ideapad 3 17iau7 Firmware | < jkcn34ww |
| Lenovo | Ideapad 3-15igl05 Firmware | < dvcn28ww |
| Lenovo | Ideapad 3-17iil05 Firmware | < emcn56ww |
| Lenovo | Ideapad 3-17itl6 Firmware | < ggcn51ww |
| Lenovo | Ideapad 5 15ial7 Firmware | < jbcn27ww |
| Lenovo | Ideapad 5-15itl05 Firmware | < fhcn70ww |
| Lenovo | L3-15iml05 Firmware | < ejcn30ww |
| Lenovo | L3-15itl6 Firmware | < gfcn29ww |
| Lenovo | Legion 5 15iah7 Firmware | < j2cn49ww |
| Lenovo | Legion 5 15iah7h Firmware | < j2cn49ww |
| Lenovo | Legion 5 Pro 16iah7 Firmware | < j2cn49ww |
| Lenovo | Legion 5 Pro 16iah7h Firmware | < j2cn49ww |
| Lenovo | Legion 5 Pro-16ith6 Firmware | < h1cn52ww |
| Lenovo | Legion 5 Pro-16ith6h Firmware | < h1cn52ww |
| Lenovo | Legion 5-15imh05 Firmware | < efcn58ww |
| Lenovo | Legion 5-15imh05h Firmware | < efcn58ww |
| Lenovo | Legion 5-15imh6 Firmware | < g8cn22ww |
| Lenovo | Legion 5-15ith6 Firmware | < h1cn52ww |
| Lenovo | Legion 5-15ith6h Firmware | < h1cn52ww |
| Lenovo | Legion 5-17imh05 Firmware | < efcn58ww |
| Lenovo | Legion 5-17imh05h Firmware | < efcn58ww |
| Lenovo | Legion 5-17ith6 Firmware | < h1cn52ww |
| Lenovo | Legion 5-17ith6h Firmware | < h1cn52ww |
| Lenovo | Legion 5p-15imh05 Firmware | < efcn58ww |
| Lenovo | Legion 5p-15imh05h Firmware | < efcn58ww |
| Lenovo | Legion 7 16iax7 Firmware | < k1cn40ww |
| Lenovo | Legion 7-16ithg6 Firmware | < h1cn52ww |
| Lenovo | S14 G2 Itl Firmware | < ggcn51ww |
| Lenovo | S14 G3 Iap Firmware | < jkcn34ww |
| Lenovo | Slim 7 14iap7 Firmware | < jhcn28ww |
| Lenovo | Slim 7 Carbon 13iap7 Firmware | < k2cn34ww |
| Lenovo | Slim 7 Prox 14iah7 Firmware | < hmcn41ww |
| Lenovo | Slim 9 14iap7 Firmware | < j3cn49ww |
| Lenovo | Thinkbook 15p Imh Firmware | < f6cn26ww |
| Lenovo | V14 G2 Ijl Firmware | < htcn31ww |
| Lenovo | V14 G3 Iap Firmware | < jkcn34ww |
| Lenovo | V15 G2 Ijl Firmware | < htcn31ww |
| Lenovo | V15 G3 Iap Firmware | < jkcn34ww |
| Lenovo | V17 G3 Iap Firmware | < jkcn34ww |
| Lenovo | S540-13itl Firmware | < fzcn26ww |
| Lenovo | Slim 7 Pro-14ihu5 Firmware | < fjcn74ww |
| Lenovo | Slim 9-14itl05 Firmware | < escn56ww |
Showing 50 of 87 affected configurations. See NVD for the full list.
References
- https://support.lenovo.com/us/en/product_security/LEN-103710Vendor Advisory
- https://support.lenovo.com/us/en/product_security/LEN-103710Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2022-3743?
A potential vulnerability was discovered in LCFC BIOS for some Lenovo consumer notebook models that could allow a local attacker with elevated privileges under certain conditions the ability to enumerate Embedded Controller (EC) commands.
How severe is CVE-2022-3743?
CVE-2022-3743 has a CVSS score of 4.4/10 (MEDIUM severity). The EPSS model estimates a 0.18% probability of exploitation in the next 30 days.
How do I fix CVE-2022-3743?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2022
- CVE-2022-37423Neo4j APOC (Awesome Procedures on Cypher) before 4.3.0.7 and…7.5
- CVE-2022-37424Files or Directories Accessible to External Parties vulnerab…6.5
- CVE-2022-37425Improper Neutralization of Special Elements used in a Comman…9.8
- CVE-2022-37426Unrestricted Upload of File with Dangerous Type vulnerabilit…7.5
- CVE-2022-37428PowerDNS Recursor up to and including 4.5.9, 4.6.2 and 4.7.1…6.5
- CVE-2022-37429Silverstripe silverstripe/framework through 4.11 allows XSS …5.4
- CVE-2022-37430Silverstripe silverstripe/framework through 4.11 allows XSS …5.4
- CVE-2022-37431A Reflected Cross-site scripting (XSS) issue was discovered …6.1
- CVE-2022-37434zlib through 1.2.12 has a heap-based buffer over-read or buf…9.8
- CVE-2022-37435Apache ShenYu Admin has insecure permissions, which may allo…8.8
- CVE-2022-37436Prior to Apache HTTP Server 2.4.55, a malicious backend can …5.3
- CVE-2022-37437When using Ingest Actions to configure a destination that re…9.8
Are you affected by CVE-2022-3743?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST