CVE-2023-5078 Security feature bypass in ThinkPad BIOS
A local attacker with elevated privileges can tamper with ThinkPad BIOS firmware, potentially compromising system integrity and security features.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-5078?
CVE-2023-5078 is a medium-severity vulnerability in Lenovo ThinkPad BIOS, published on 8 Nov 2023. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A vulnerability was reported in some ThinkPad BIOS that could allow a physical or local attacker with elevated privileges to tamper with BIOS firmware.
Weakness: CWE-1419
Which versions are affected by CVE-2023-5078?
It affects 20 products.
Products include Lenovo Thinkpad L13 Gen 2 Firmware, Lenovo Thinkpad L13 Gen 3 Firmware, Lenovo Thinkpad L13 Gen 4 Firmware, Lenovo Thinkpad L13 Yoga Gen 2 Firmware, Lenovo Thinkpad L13 Yoga Gen 3 Firmware, Lenovo Thinkpad L13 Yoga Gen 4 Firmware and 14 more.
How do I fix CVE-2023-5078?
No fix has been published for CVE-2023-5078 yet. Limit exposure of the affected software until one is available.
Is CVE-2023-5078 being exploited?
There is no known exploitation of CVE-2023-5078 in the wild and no public exploit code.
Sources
Also known as GHSA-7hgj-2cr9-625f.