Vulnerabilidades em Lenovo
394 resultadosAnálise Vexday
Com 369 CVEs catalogadas, o portfólio de vulnerabilidades da Lenovo apresenta taxa de exploração ativa abaixo da média geral do catálogo KEV, sem registros confirmados de exploração em curso. O tipo de falha mais frequente é CWE-20 (validação inadequada de entrada), o que sugere atenção recorrente à sanitização de dados em componentes de firmware e software proprietário. A CVE mais perigosa identificada atualmente é CVE-2022-3699, com score EPSS de 0,0428 — o maior valor observado no conjunto —, indicando probabilidade de exploração ainda relativamente baixa, mas suficiente para justificar priorização em ambientes corporativos que dependem de hardware Lenovo. As 13 vulnerabilidades surgidas nos últimos 90 dias e a presença de 4 falhas críticas reforçam a necessidade de ciclos regulares de atualização de firmware e drivers.
CVE-2025-6248HIGHA cross-site scripting (XSS) vulnerability was reported in the Lenovo Browser that could allow an attacker to obtain sensitive information iEPSS 0.3%CVE-2024-4781MEDIUMA denial-of-service vulnerability was reported in some Lenovo printers that could allow an unauthenticated attacker on a shared network to cEPSS 0.3%CVE-2020-8333MEDIUMA potential vulnerability in the SMI callback function used in the EEPROM driver in some Lenovo Desktops and ThinkStation models may allow aEPSS 0.3%CVE-2019-6172MEDIUMA potential vulnerability in the SMI callback function used in Legacy USB driver using passed parameter without sufficient checking in some EPSS 0.3%CVE-2024-23593MEDIUM
A vulnerability was reported
in a system recovery bootloader that was part of the Lenovo preloaded Windows 7 and 8 operating systems from EPSS 0.3%CVE-2020-8323MEDIUMA potential vulnerability in the SMI callback function used in the Legacy SD driver in some Lenovo ThinkPad, ThinkStation, and Lenovo NoteboEPSS 0.3%CVE-2020-8322MEDIUMA potential vulnerability in the SMI callback function used in the Legacy USB driver in some Lenovo Notebook and ThinkStation models may allEPSS 0.3%CVE-2020-8334MEDIUMThe BIOS tamper detection mechanism was not triggered in Lenovo ThinkPad T495s, X395, T495, A485, A285, A475, A275 which may allow for unautEPSS 0.3%CVE-2019-6191—A potential vulnerability in the discontinued LenovoPaper software version 1.0.0.22 may allow local privilege escalation.EPSS 0.3%CVE-2019-6189—A potential vulnerability was reported in Lenovo System Interface Foundation versions before v1.1.18.3 that could allow an administrative usEPSS 0.3%CVE-2023-4632HIGHAn uncontrolled search path vulnerability was reported in Lenovo System Update that could allow an attacker with local access to execute codEPSS 0.3%CVE-2019-6173MEDIUMA DLL search path vulnerability could allow privilege escalation in some Lenovo installation packages, prior to version 1.2.9.3, during instEPSS 0.3%CVE-2020-8335MEDIUMThe BIOS tamper detection mechanism was not triggered in Lenovo ThinkPad A285, BIOS versions up to r0xuj70w; A485, BIOS versions up to r0wujEPSS 0.3%CVE-2020-8352LOWIn some Lenovo Desktop models, the Configuration Change Detection BIOS setting failed to detect SATA configuration changes.EPSS 0.3%CVE-2021-3615MEDIUMA vulnerability was reported in Lenovo Smart Camera X3, X5, and C2E that could allow code execution if a specific file exists on the attacheEPSS 0.3%CVE-2019-19756HIGHAn internal product security audit of Lenovo XClarity Administrator (LXCA) discovered Windows OS credentials, used to perform driver updatesEPSS 0.3%CVE-2024-8058HIGHAn improper parsing vulnerability was reported in the FileZ client that could allow a crafted file in the FileZ directory to read arbitrary EPSS 0.3%CVE-2024-4782MEDIUMA denial-of-service vulnerability was reported in some Lenovo printers that could allow an unauthenticated attacker on a shared network to dEPSS 0.3%CVE-2020-8336MEDIUMLenovo implemented Intel CSME Anti-rollback ARB protections on some ThinkPad models to prevent roll back of CSME Firmware in flash.EPSS 0.3%CVE-2022-3432MEDIUMA potential vulnerability in a driver used during manufacturing process on the Ideapad Y700-14ISK that was mistakenly not deactivated may alEPSS 0.3%