CVE-2024-7756

State: Published
Severity: 6.8 Medium
Published: Sep 13, 2024
Updated: Sep 16, 2024
Reserved: Aug 13, 2024

Description

A potential vulnerability was reported in the ThinkPad L390 Yoga and 10w Notebook that could allow a local attacker to escalate privileges by accessing an embedded UEFI shell.

Scores

CVSS	Score	Vector	Source
3.1	6.8 Medium	CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	lenovo

Weaknesses

CWE-489 Active Debug Code

Affected Products

Product	Versions
10w (Type 82ST, 82SU) Laptop (Lenovo) BIOSLenovo	before JSCN28WWAffected
L390 (type 20NR, 20NS) Laptops (ThinkPad) BIOSLenovo	before 1.47Affected
L390 Yoga (type 20NT, 20NU) Laptops (ThinkPad) BIOSLenovo	before 1.47Affected

References

https://support.lenovo.com/us/en/product_security/LEN-165524

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.