Improper BIOS initialization enables privileged code execution on Lenovo ThinkPad

A potential improper initialization vulnerability was reported in the BIOS of some ThinkPads that could allow a local privileged user to modify data and execute arbitrary code.

The normalized record sets the default status to unaffected and explicitly lists the following ranges as affected:

• Lenovo ThinkPad T14 Gen 5 BIOS: versions from 0 through 1.17, inclusive.
• Lenovo ThinkPad P14s Gen 5 BIOS: versions from 0 through 1.17, inclusive.
• Lenovo ThinkPad Z13 Gen 2 BIOS: versions from 0 through 1.37, inclusive.
• Lenovo ThinkPad Z16 Gen 2 BIOS: versions from 0 through 1.37, inclusive.
• Lenovo ThinkPad P16v Gen 1 BIOS: versions from 0 through 1.62, inclusive.
• Lenovo ThinkPad P15v Gen 3 BIOS: versions from 0 through 1.28, inclusive.
• Lenovo ThinkPad Z13 Gen 1 BIOS: versions from 0 through 1.76, inclusive.
• Lenovo ThinkPad Z16 Gen 1 BIOS: versions from 0 through 1.76, inclusive.

The record does not provide one fixed-version boundary that applies to all eight branches. Any branch or configuration not listed should be verified by model against Lenovo's Product Impact guidance.

This is an Improper Initialization flaw, classified as CWE-665, in the BIOS firmware of affected Lenovo ThinkPad models. At a high level, a state or value required by the BIOS may not be initialized correctly, but the record does not identify the specific object, code path, or configuration condition involved. An attacker must already be a local user with high privileges on the device; exploitation is rated low complexity and requires no interaction from another user. The stated result is data modification and arbitrary code execution. The record does not identify the attacker-controlled input, the specific BIOS interface, or whether the operation is reached from the operating system, a pre-boot environment, or another component.

• The vulnerability is described as locally reachable, not as a network entry point.
• The attacker must have high privileges on the device, and no interaction from another user is required.
• The recorded attack complexity is low.
• The supplied record does not identify a public exploit; its known-exploited field is not marked. This does not prove that exploitation has never occurred outside the available evidence.
• No exploit code, campaign, victim, or specific exploitation path is identified in the evidence reviewed.

The vulnerability could result in data modification and arbitrary code execution on an affected Lenovo ThinkPad system. The impact attributes in the record indicate potentially severe effects on system confidentiality, integrity, and availability, while no changed-scope impact is identified. Requiring a local highly privileged user limits triggering from an ordinary account or directly from the network, but the consequences after successful exploitation could still be substantial. The record does not establish persistence, remote access, lateral movement, or impact to other systems.

• A successful attack could let an attacker modify data and execute arbitrary code on an affected Lenovo ThinkPad.
• Possible consequences include loss of system confidentiality, integrity, or availability, together with device isolation, recovery, or redeployment work.
• The requirement for high local privileges narrows who can trigger the flaw, but it does not remove the risk on systems where a privileged account has been compromised or misused.
• The evidence does not identify a breach, victim, campaign, spread to other systems, or fleet-wide impact.

1. Update the BIOS for each affected model to the version Lenovo specifies for that exact model in the advisory's Product Impact section. Do not assume that a fix for one branch applies to another branch.
2. After updating, verify the BIOS version on the device and refresh endpoint inventory. The record provides model-specific update guidance but does not state one common fixed version for all products.
3. Until the update can be applied, limit local privileged access to trusted users and protect access to BIOS settings with a strong password. This is an interim risk reduction measure, not a replacement for the firmware update.
4. For devices that cannot be updated through the normal process, reconcile the exact model and BIOS branch with Lenovo support guidance before making an operational exception.

1. Inventory Lenovo ThinkPad devices and record the exact model, machine type where available, and installed BIOS version.
2. Compare each model with the affected branches in affected_summary. Do not apply one model's threshold to another model.
3. Check the deployment status of the BIOS update supplied by Lenovo and verify the installed version again after maintenance is complete.
4. Prioritize review of devices that can be accessed or have firmware settings changed by local privileged accounts.
5. The available evidence provides no specific log event, IOC, or compromise indicator. Monitoring for unexpected firmware or system-data changes is a precaution only, and the absence of log evidence does not prove that a device is safe.