Search/CVE-2022-1107
● CVE — Medium

CVE-2022-1107

VendorlenovoProductthinkpad helix firmware, thinkpad 11e firmware, thinkpad t550 firmware, thinkpad w550s firmware, thinkpad x1 carbon 3rd gen firmware, thinkpad x250 firmware, thinkpad x1 carbon 5th gen kabylake firmware, thinkpad x1 carbon 5th gen skylake firmware, thinkpad l560 firmware, thinkpad l570 firmware, thinkpad p50s firmware, thinkpad p51s firmware, thinkpad p52s firmware, thinkpad s540 firmware, thinkpad t560 firmware, thinkpad t570 firmware, thinkpad t580 firmware, thinkpad w540 firmware, thinkpad w541 firmware, thinkpad x1 carbon 4th gen firmware, thinkpad x1 tablet gen 1 firmware, thinkpad x1 tablet gen 2 firmware, thinkpad x1 yoga firmware, thinkpad x1 yoga gen 2 firmware, thinkpad x1 yoga gen 3 firmwareDiscoveredApr 22, 2022UpdatedNov 21, 2024

During an internal product security audit a potential vulnerability due to use of Boot Services in the SmmOEMInt15 SMI handler was discovered in some ThinkPad models could be exploited by an attacker with elevated privileges that could allow for execution of code.

View graph Watch Export
CVSS v3.1
6.7 MEDIUM
EPSS
0.27%
probability of exploitation in 30 days
CISA KEV
Not listed
no confirmed exploitation reported
News coverage
0
sources referencing this CVE
Related IOCs
0
seen in the same coverage
EPSS Trend
Aug 16, 2026 → Sep 12, 2026
▲ 0.02pp
0.25% → 0.27% over 3 tracked changes
CVSS v3.1 Detail
Attack VectorLOCAL
Attack ComplexityLOW
Privileges RequiredHIGH
User InteractionNONE
ScopeUNCHANGED
ConfidentialityHIGH
IntegrityHIGH
AvailabilityHIGH
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Connections
26 relationships
Timeline
disclosure → media coverage
Apr 22, 2022
Disclosure — published as a CVE record. · last revised by NVD Nov 21, 2024