Known vulnerabilities in Lenovo System UEFI/BIOS Firmware

Known vulnerabilities in Lenovo System UEFI/BIOS Firmware

Vendor: Lenovo

Software: Lenovo System UEFI/BIOS Firmware

Software CPE: cpe:2.3:h:lenovo:lenovo_system_uefi_bios_firmware:*:*:*:*:*:*:*:*

Website: https://www.lenovo.com/

Total vulnerabilities: 18

Public exploits: 0

Known exploited (KEV): 0

Highest CVSSv4 Score: 8.7

Breakdown by Severity Chart

Vulnerabilities (18)

Vulnerability	CWE-ID	CSH Severity	Public Exploit	KEV	First fixed release	Published	Bulletins
#VU119817 - State Issues CVE-2025-9614	CWE-371	Low	No	No	-	10.12.2025	SB20251210202 SB2025122701
#VU119816 - Insufficient Technical Documentation CVE-2025-9613	CWE-1059	Low	No	No	-	10.12.2025	SB20251210202 SB2025122701
#VU119815 - Improper Validation of Integrity Check Value CVE-2025-9612	CWE-354	Low	No	No	-	10.12.2025	SB20251210202 SB2025122701
#VU119804 - Exposure of sensitive information to an unauthorized actor CVE-2024-38798	CWE-200	Low	No	No	-	10.12.2025	SB20251210176 SB2025122701 SB2026020648 and 2 more
#VU119030 - Exposure of Sensitive System Information to an Unauthorized Control Sphere CVE-2025-47319	CWE-497	Low	No	No	-	02.12.2025	SB2025120232 SB2025122701
#VU119032 - Integer overflow CVE-2025-47323	CWE-190	Low	No	No	-	02.12.2025	SB2025120232 SB2025122701
#VU117652 - Insufficient Entropy CVE-2025-62626	CWE-331	Low	No	No	-	24.10.2025	SB2025102470 SB2025120853 SB2025122706 and 21 more
#VU112557 - Information Exposure through Microarchitectural State after Transient Execution CVE-2024-36349	CWE-1342	Low	No	No	-	08.07.2025	SB2025070901 SB2025070903 SB2025072844 and 9 more
#VU112556 - Information Exposure through Microarchitectural State after Transient Execution CVE-2024-36348	CWE-1342	Low	No	No	-	08.07.2025	SB2025070901 SB2025070903 SB2025072844 and 9 more
#VU112552 - Information Exposure through Microarchitectural State after Transient Execution CVE-2024-36357	CWE-1342	Low	No	No	-	08.07.2025	SB2025070882 SB2025070903 SB2025070904 and 43 more
#VU112549 - Information Exposure through Microarchitectural State after Transient Execution CVE-2024-36350	CWE-1342	Low	No	No	-	08.07.2025	SB2025070882 SB2025070903 SB2025070904 and 40 more
#VU109411 - Improper Access Control CVE-2025-20100	CWE-284	Low	No	No	-	19.05.2025	SB2025051921 SB2025072844
#VU109410 - Insufficient Control Flow Management CVE-2025-20004	CWE-691	Low	No	No	-	19.05.2025	SB2025051921 SB2025072844
#VU109409 - Improper restriction of software interfaces to hardware features CVE-2024-48869	CWE-1256	Low	No	No	-	19.05.2025	SB2025051921 SB2025072844
#VU98415 - Improper Check for Unusual or Exceptional Conditions CVE-2024-27457	CWE-754	Low	No	No	USE132F	11.10.2024	SB2024101141 SB2025010857 SB2025022431 and 2 more
#VU95180 - Integer overflow CVE-2022-36765	CWE-190	Low	No	No	USE124L	02.08.2024	SB2024080236 SB2024021453 SB2024021639 and 8 more
#VU89083 - Integer overflow CVE-2022-36763	CWE-190	Low	No	No	USE124L	01.05.2024	SB2024011752 SB2024050117 SB2024021453 and 9 more
#VU87737 - Integer overflow CVE-2022-36764	CWE-190	Medium	No	No	USE124L	22.03.2024	SB2024011752 SB2024032253 SB2024032254 and 11 more