Vulnerability in Lenovo L13 2-in-1 Gen 6 (Type 21r7, 21r8) Laptops (Thinkpad) Bios
CVE-2025-10237
During an internal security assessment, a potential vulnerability was discovered in some ThinkPad embedded controller firmware that could allow a privileged local user to perform arbitrary reads or writes to privileged memory regions.
Vulnerability class: POODLE (CVE-2014-3566)
EPSS: 0.001 (0.1th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 6.7 (Medium). Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Lenovo L13 2-in-1 Gen 6 (Type 21r7, 21r8) Laptops (Thinkpad) Bios — versions 0
- Lenovo L13 Gen 4 (Type 21fg, 21fh) Laptop (Thinkpad) Bios — versions 0
- Lenovo L13 Gen 5 (Type 21lb, 21lc) Laptops (Thinkpad) Bios — versions 0
- Lenovo L13 Gen 6 (Type 21rb, 21rc) Laptops (Thinkpad) Bios — versions 0
- Lenovo L13 (Type 20r3, 20r4) Laptops (Thinkpad) Bios — versions 0
- Lenovo L13 Yoga Gen 3 (Type 21b5, 21b6) Laptop (Thinkpad) Bios — versions 0
- Lenovo L14 Gen 2 Type 20x1 20x2 Laptops (Thinkpad) Bios — versions 0
- Lenovo L14 Gen 2 (Type 20x5, 20x6) Laptop (Thinkpad) Bios — versions 0
- Lenovo L14 Gen 3 (Type 21c1, 21c2) Laptops (Thinkpad) Bios — versions 0
- Lenovo L14 Gen 3 (Type 21c5, 21c6) Laptops (Thinkpad) Bios — versions 0
Weakness classification (CWE)
References
- psirt@lenovo.com (vendor-advisory)
Frequently asked questions
- What is CVE-2025-10237?
- CVE-2025-10237 is a medium-severity vulnerability in Lenovo L13 2-in-1 Gen 6 (Type 21r7, 21r8) Laptops (Thinkpad) Bios, classified under Use of a Broken or Risky Cryptographic Algorithm. CVSS score: 6.7/10. Published 2026-06-10.
- How severe is CVE-2025-10237?
- Medium severity. CVSS v3 base score is 6.7 out of 10.