EUVD-2025-210107
GHSA-9h3m-vgr9-8wvv
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain local admin on ThinkPad
-
DeliveryIdentify vulnerable EC firmware version
-
ExploitIssue crafted EC command from OS
-
ExecutionBypass weak crypto authorization check
-
PersistRead/write privileged EC memory
-
ImpactInstall firmware-level persistence or disable platform protections
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A04:2025 - Cryptographic Failures
ASVS 5.0
V11 - Cryptography Approved algorithm selection
|
| Exploitation Conditions | Exploitation requires local code execution on the affected ThinkPad with high privileges (PR:H - administrator/root on the host OS) and one of the specific affected ThinkPad models running an unpatched BIOS/EC firmware image as enumerated in LEN-218282 (X13 Gen 6, X1 Carbon 13th Gen, P16v Gen 3, P14s Gen 6, T14s Gen 6, L13 Gen 6, L14 Gen 6, L16 Gen 1, L16 Gen 2). No user interaction is needed once admin access is held (UI:N), and the attack vector is strictly local (AV:L) - it cannot be triggered remotely or over the network and cannot be exploited from a standard unprivileged user account, which materially limits the population of viable attackers to those who have already achieved admin compromise, physical possession, or supply-chain insertion. |
| Impact | The CVSS 4.0 vector AV:L/AC:L/AT:N/PR:H/UI:N with VC:H/VI:H/VA:H reflects a high-impact local attack that already requires administrative privileges, which is why the score lands at 8.4 rather than critical. There is no EPSS score, no KEV listing, and no public PoC referenced - the finding originated from Lenovo's own internal security assessment, so this is not a widespread opportunistic threat. The realistic risk concentrates on post-compromise privilege persistence (an attacker with admin can pivot into firmware-level control that survives reboots and reinstalls), evil-maid/supply-chain scenarios, and targeted attacks against high-value ThinkPad users. The CWE-327 (cryptographic) labeling is somewhat inconsistent with the description's framing of arbitrary memory read/write - the underlying flaw is more likely an authentication-bypass in an EC command handler whose authorization relies on weak crypto, but the exact mechanism is not disclosed and should be verified against Lenovo's advisory. |
| Exploit ScenarioDerived | An attacker who has obtained local administrator privileges on an affected ThinkPad - for example via a phishing payload that escalated to admin, or an insider with elevated rights - invokes the vulnerable EC interface from the OS to read sensitive material out of protected EC memory or to write a malicious payload into regions used by power/security logic. This yields firmware-level persistence or disablement of platform protections that survives OS reinstalls. No public exploit is identified at time of analysis, so weaponization currently requires private research effort. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 10, 2026
Arbitrary privileged memory read/write in Lenovo ThinkPad embedded controller (EC) firmware allows a local administrator on affected ThinkPad models (X13 Gen 6, X1 Carbon 13th Gen, P16v Gen 3, L16 Gen 1/2, T14s Gen 6, P14s Gen 6, L13 Gen 6, L14 Gen 6) to access or modify protected memory regions. Discovered during Lenovo's internal security assessment, the issue is rated CVSS 4.0 8.4 (High) and there is no public exploit identified at time of analysis, with no CISA KEV listing. Despite the high score, exploitation requires high privileges and local access, narrowing realistic abuse to attackers who already have admin on the host or to supply-chain/insider scenarios.
RemediationAI
Apply the BIOS/EC firmware update published by Lenovo for your specific ThinkPad model and machine type as listed in advisory LEN-218282 (https://support.lenovo.com/us/en/product_security/LEN-218282); exact fixed versions per model are documented there and should be cross-checked against the machine type printed on the chassis before flashing. Until updates are deployed, treat local administrator privilege on these laptops as equivalent to firmware-level compromise: minimize the number of users with admin rights, enforce full-disk encryption with pre-boot authentication, enable Secure Boot and a BIOS supervisor password to slow tampering, and restrict physical access for travelers (the trade-off is added user friction and helpdesk overhead for password resets). Application control / driver allow-listing can raise the bar against the user-mode tooling typically used to drive EC SMBus commands, but it will not stop an actual admin who already has kernel access.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 88 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability resides in the embedded controller (EC) firmware shipped as part of the ThinkPad BIOS package. The EC is a dedicated microcontroller below the OS that handles power management, thermals, keyboard, battery, and platform security signaling, and it owns memory regions that the host OS is not supposed to touch. CWE-327 (Use of a Broken or Risky Cryptographic Algorithm) is the assigned weakness class, suggesting that an authorization or integrity check guarding privileged EC memory operations relies on weak or improperly used cryptography, letting a privileged caller bypass the intended boundary and issue arbitrary reads or writes against protected regions. Because the EC sits below the OS trust boundary, compromise can affect firmware integrity in ways that survive OS reinstalls.
Know when X13 Gen 6 Type 21Rk 21Rl Laptops Thinkpad Bios gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Primary rating from Vendor (lenovo) · only source for this CVE.
CVSS VectorVendor: lenovo
Lifecycle Timeline
4DescriptionCVE.org
During an internal security assessment, a potential vulnerability was discovered in some ThinkPad embedded controller firmware that could allow a privileged local user to perform arbitrary reads or writes to privileged memory regions.
Executive ViewAI
Lenovo ThinkPad embedded controller firmware on eight enterprise models (X13 Gen 6, X1 Carbon Gen 13, P16v Gen 3, L16 Gen 1/2, T14s Gen 6, P14s Gen 6, L13 Gen 6, L14 Gen 6) contains a high-severity privilege escalation vulnerability (CVSS 8.4) allowing local administrators to read and modify protected memory regions. While no public exploit has been identified at time of analysis, compromise of administrative credentials or insider threats could enable firmware manipulation and data theft.
No vendor-released patch identified at time of analysis. Interim mitigations: enforce Secure Boot and UEFI firmware password protection to prevent unauthorized firmware modification; restrict firmware updates to scheduled maintenance windows only; implement certificate-based firmware integrity checking; limit local administrator privileges to essential personnel only; deploy endpoint detection and response (EDR) tools configured to alert on firmware modification or EC access attempts; require multi-factor authentication for administrative access; conduct quarterly access reviews on privileged accounts.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB