Critical severity · published Nov 12, 2019
CVE-2019-6188
The BIOS tamper detection mechanism was not triggered in Lenovo ThinkPad T460p, BIOS versions up to R07ET90W, and T470p, BIOS versions up to R0FET50W, which may allow for…
9.8
CVSS
1.3%
EPSS
No
On KEV
Description
The BIOS tamper detection mechanism was not triggered in Lenovo ThinkPad T460p, BIOS versions up to R07ET90W, and T470p, BIOS versions up to R0FET50W, which may allow for unauthorized access.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.3% · higher than 71% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
5F
510-15ikl Firmware · Lenovo
All versions, or not specified · source: NVD
5F
510s-08ikl Firmware · Lenovo
All versions, or not specified · source: NVD
6F
63 Firmware · Lenovo
All versions, or not specified · source: NVD
HD
H50-30g Desktop Firmware · Lenovo
All versions, or not specified · source: NVD
I3
Ideacentre 300-20ish Firmware · Lenovo
All versions, or not specified · source: NVD
I3
Ideacentre 300s-11ish Firmware · Lenovo
All versions, or not specified · source: NVD
I3
Ideacentre 310s-08asr Firmware · Lenovo
All versions, or not specified · source: NVD
I3
Ideacentre 310s-08igm Firmware · Lenovo
All versions, or not specified · source: NVD
I5
Ideacentre 510-15icb Firmware · Lenovo
All versions, or not specified · source: NVD
I5
Ideacentre 510a-15icb Firmware · Lenovo
All versions, or not specified · source: NVD
I5
Ideacentre 510s-08ish Firmware · Lenovo
All versions, or not specified · source: NVD
I7
Ideacentre 700 Firmware · Lenovo
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-6188
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-6188
Vendor Advisory
https://support.lenovo.com/us/en/product_security/LEN-27714
More from 510-15ikl Firmware
6.4
CVE-2019-6172
A potential vulnerability in the SMI callback function used in Legacy USB driver using passed parameter without sufficient checking in some Lenovo ThinkPad models may allow…
6.4
CVE-2019-6170
A potential vulnerability in the SMI callback function used in the Legacy USB driver using boot services structure in runtime phase in some Lenovo ThinkPad models may allow…
3.3
CVE-2019-6156
In Lenovo systems, SMM BIOS Write Protection is used to prevent writes to SPI Flash