Lenono warns of ‘high’ security risks to 20+ laptops – here’s the list, how to fix them

MORRISVILLE – Lenovo has issued what it calls a “high” risk security warning for more than 20 models of various laptops. It also is explaining to owners how to fix the problems.

The vulnerabilities are linked to the machines’ so-called BIOS (basic input/output system) which is the program a computer’s microprocessor uses to start the computer system after it is powered on. It also manages data flow between the computer’s operating system (OS) and attached devices, such as the hard disk, video adapter, keyboard, mouse and printer, according to TechTarget. 

The vulnerabilities as explained by Lenovo, the world’s top PC seller which operates dual headquarters in the Triangle and Beijing:

• CVE-2022-3430: A potential vulnerability in the WMI Setup driver on some consumer Lenovo Notebook devices may allow an attacker with elevated privileges to modify secure boot setting by modifying an NVRAM variable.
• CVE-2022-3431: A potential vulnerability in a driver used during manufacturing process on some consumer Lenovo Notebook devices that was mistakenly not deactivated may allow an attacker with elevated privileges to modify secure boot setting by modifying an NVRAM variable.
• CVE-2022-3432: A potential vulnerability in a driver used during manufacturing process on the Ideapad Y700-14ISK that was mistakenly not deactivated may allow an attacker with elevated privileges to modify secure boot setting by modifying an NVRAM variable.

To mitigate the problems – or “what you should do to protect yourself,” Lenovo says:

• For CVE-2022-3430 and CVE-2022-3431, update system firmware to the version (or newer) indicated for your model in the product Impact section.
• For CVE-2022-3432, the Ideapad Y700-14ISK has reached end of development support and no fixes will be released. Lenovo recommends customers adopt secure computing practices, including active system lifecycle management.

Here’s a list of affected models:

enovo Notebook

For more information, visit: https://support.lenovo.com/us/en/product_security/LEN-94952