What is the CVSS score of CVE-2016-8226?

CVE-2016-8226 has a CVSS 3.0 base score of 4.9 (Medium). CVSS vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.3%.

Flex System X240 M5 Bios CVE-2016-8226

MEDIUM

Data Processing Errors (CWE-19)

2017-01-26 psirt@lenovo.com

Denial Of Service Lenovo Flex System X240 M5 Bios Flex System X280 M6 Bios Flex System X480 X6 Bios Flex System X880 X6 Bios Nextscale Nx360 M5 Bios System X3250 M6 Bios System X3500 M5 Bios System X3550 M5 Bios System X3650 M5 Bios System X3850 X6 Bios System X3950 X6 Bios

4.9

CVSS 3.0 · NVD

Severity by source

NVD PRIMARY

4.9 MEDIUM

AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

CVE Published

Jan 26, 2017 - 17:59 cve.org

MEDIUM 4.9

DescriptionCVE.org

The BIOS in Lenovo System X M5, M6, and X6 systems allows administrators to cause a denial of service via updating a UEFI data structure.

AnalysisAI

The BIOS in Lenovo System X M5, M6, and X6 systems allows administrators to cause a denial of service via updating a UEFI data structure. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-19. The BIOS in Lenovo System X M5, M6, and X6 systems allows administrators to cause a denial of service via updating a UEFI data structure. Affected products include: Lenovo Flex System X240 M5 Bios, Lenovo Flex System X280 M6 Bios, Lenovo Flex System X480 X6 Bios, Lenovo Flex System X880 X6 Bios, Lenovo Nextscale Nx360 M5 Bios.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.