How severe is CVE-2023-4030?

CVE-2023-4030 has a CVSS 3.x base score of 8.4, rated high severity. It is exploitable over local access with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.

Is CVE-2023-4030 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (8th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2023-4030?

CVE-2023-4030 primarily affects Lenovo Thinkpad T15 Gen 2 Firmware. In total, 4 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2023-4030?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.

When was CVE-2023-4030 published?

CVE-2023-4030 was published on 2023-08-17 and last updated on 2026-06-17.

CVE-2023-4030

CVE-2023-4030 is a high-severity vulnerability in Lenovo Thinkpad T15 Gen 2 Firmware with a CVSS 3.x base score of 8.4. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-636.

Key facts

Severity: High (CVSS 3.x base score 8.4)
EPSS exploit prediction: 0% (8th percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-636
Affected product: Lenovo Thinkpad T15 Gen 2 Firmware
Published: 2023-08-17
Last modified: 2026-06-17

Description

A vulnerability was reported in BIOS for ThinkPad P14s Gen 2, P15s Gen 2, T14 Gen 2, and T15 Gen 2 that could cause the system to recover to insecure settings if the BIOS becomes corrupt.

Frequently asked questions

What is CVE-2023-4030?: A vulnerability was reported in BIOS for ThinkPad P14s Gen 2, P15s Gen 2, T14 Gen 2, and T15 Gen 2 that could cause the system to recover to insecure settings if the BIOS becomes corrupt.
How severe is CVE-2023-4030?: CVE-2023-4030 has a CVSS 3.x base score of 8.4, rated high severity. It is exploitable over local access with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.
Is CVE-2023-4030 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (8th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2023-4030?: CVE-2023-4030 primarily affects Lenovo Thinkpad T15 Gen 2 Firmware. In total, 4 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2023-4030?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
When was CVE-2023-4030 published?: CVE-2023-4030 was published on 2023-08-17 and last updated on 2026-06-17.

References

https://support.lenovo.com/us/en/product_security/LEN-134879

Affected products (4)

cpe:2.3:o:lenovo:thinkpad_t15_gen_2_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:lenovo:thinkpad_p14s_gen_2_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:lenovo:thinkpad_p15s_gen_2_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:lenovo:thinkpad_t14_gen_2_firmware:-:*:*:*:*:*:*:*

More vulnerabilities in Lenovo Thinkpad T15 Gen 2 Firmware

CVE-2022-4574 — Medium (CVSS 6.7): An SMI handler input validation vulnerability in the BIOS of some ThinkPad models could allow an attacker with local…
CVE-2022-48189 — Medium (CVSS 6.7): An SMM driver input validation vulnerability in the BIOS of some ThinkPad models could allow an attacker with local…
CVE-2021-3599 — Medium (CVSS 6.7): A potential vulnerability in the SMI callback function used to access flash device in some ThinkPad models may allow an…
CVE-2023-2290 — Medium (CVSS 6.4): A potential vulnerability in the LenovoFlashDeviceInterface SMI handler may allow an attacker with local access and…
CVE-2022-40134 — Medium (CVSS 4.4): An information leak vulnerability in the SMI Set BIOS Password SMI Handler in some Lenovo models may allow an attacker…
CVE-2021-3786 — Medium (CVSS 4.4): A potential vulnerability in the SMI callback function used in CSME configuration of some Lenovo Notebook and ThinkPad…

All CVEs affecting Lenovo Thinkpad T15 Gen 2 Firmware →

Other CWE-636 vulnerabilities

CVE-2026-22034 — Critical (CVSS 9.8): Snuffleupagus is a module that raises the cost of attacks against website by killing bug classes and providing a…
CVE-2024-3729 — Critical (CVSS 9.8): The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to improper missing encryption exception handling…
CVE-2026-40525 — Critical (CVSS 9.1): OpenViking prior to version 0.3.9 contains an authentication bypass vulnerability in the VikingBot OpenAPI HTTP route…
CVE-2024-43532 — High (CVSS 8.8): Remote Registry Service Elevation of Privilege Vulnerability
CVE-2025-54870 — High (CVSS 8.7): VTun-ng is a Virtual Tunnel over TCP/IP network. In versions 3.0.17 and below, failure to initialize encryption modules…
CVE-2026-54762 — High (CVSS 8.6): Traefik is an HTTP reverse proxy and load balancer. From 3.7.0-ea.1 until 3.7.5, there is a medium severity…

Browse all CWE-636 vulnerabilities →