E42 80 Firmware
CVE-2018-9069
MEDIUM
Severity by source
AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
1DescriptionNVD
In some Lenovo IdeaPad consumer notebook models, a race condition in the BIOS flash device locking mechanism is not adequately protected against, potentially allowing an attacker with administrator access to alter the contents of BIOS.
AnalysisAI
In some Lenovo IdeaPad consumer notebook models, a race condition in the BIOS flash device locking mechanism is not adequately protected against, potentially allowing an attacker with administrator. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable. No vendor patch available.
Technical ContextAI
This vulnerability is classified under CWE-362. In some Lenovo IdeaPad consumer notebook models, a race condition in the BIOS flash device locking mechanism is not adequately protected against, potentially allowing an attacker with administrator access to alter the contents of BIOS. Affected products include: Hp 310S-14Isk Firmware, Hp 320-15Ikbra Firmware, Hp 320-15Ikbrn Firmware, Hp 320-15Ikbrn Touch Firmware, Hp 320-17Ikbrn.
RemediationAI
No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.
More in E42 80 Firmware
View allThe BIOS tamper detection mechanism was not triggered in Lenovo ThinkPad T460p, BIOS versions up to R07ET90W, and T470p,
In some Lenovo ThinkPad products, one BIOS region is not properly included in the checks, allowing injection of arbitrar
A potential vulnerability in the SMI callback function used in the Legacy SD driver in some Lenovo ThinkPad, ThinkStatio
A potential vulnerability in the SMI callback function used in the Legacy USB driver in some Lenovo Notebook and ThinkSt
A potential vulnerability in the SMI callback function used in Legacy USB driver using passed parameter without sufficie
A potential vulnerability in the SMI callback function used in the Legacy USB driver using boot services structure in ru
Same weakness CWE-362 – Race Condition
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today