CVE-2023-4030
Lenovo Thinkpad T15 Gen 2 Firmware
Raw vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HSummary
CVE-2023-4030 is a high-severity Failing Open (CWE-636) vulnerability in Lenovo Thinkpad T15 Gen 2 Firmware. Its CVSS base score is 8.4 (High).
Operationally, ranked at the 9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-53923
Vulnerability Data
A vulnerability was reported in BIOS for ThinkPad P14s Gen 2, P15s Gen 2, T14 Gen 2, and T15 Gen 2 that could cause the system to recover to insecure settings if the BIOS becomes corrupt.
- CWE(s)
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V3.2.1V7.4.1V8.3.3V10.3.4
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Ensures audit logging continues on primary failure instead of failing open with no logging capability.
Supports failing securely by requiring alerts and configurable actions (e.g., shutdown) when the audit mechanism fails instead of continuing without it.
Entering safe mode when conditions are detected prevents failing open and continuing normal operation in a potentially exploitable state.
Ensures security functions remain enforced via alternatives instead of defaulting to an insecure state when the primary means fails.
Fail-safe-defaults principle prevents systems from failing open.
Directly requires transition to a known (secure) state on failure, preventing fail-open behavior.
Standby components and explicit exchange criteria enforce a controlled, secure failover instead of failing open.
Directly implements fail-safe (fail-closed/secure) behavior on indicated failures, preventing the system from defaulting to an insecure open state.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure-development practices explicitly include designing error and failure handling to remain in a secure state.
Least-privilege policy and enforcement directly counters the permissive-access fallback example in the CWE.
Hardened baselines and configuration management reduce the chance that error paths default to insecure settings.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
The control forces an explicit evaluation step before any response, reducing the chance that a failure condition will default to an unsafe open state.