CVE-2018-9069

moderate-risk
Published 2018-10-02

In some Lenovo IdeaPad consumer notebook models, a race condition in the BIOS flash device locking mechanism is not adequately protected against, potentially allowing an attacker with administrator access to alter the contents of BIOS.

Do I need to act?

-
0.21% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
5
CVSS 5.9/10 Medium
NETWORK / HIGH complexity

Affected Products (20)

310S-14Isk Firmware
320-15Ikbra Firmware
320-15Ikbrn Firmware
320-15Ikbrn Touch Firmware
320-17Ikbrn
320S-14Ikb
320S-15Ikb Firmware
320S-15Isk Firmware
510S-14Isk Firmware
520-15Ikbrn Firmware
520S-14Ikb Firmware
710S Plus-13Ikb 16G Firmware
710S Plus-3Ikb Firmware
Xiaoxinair13Ikbpro Firmware
710S Plus Touch-13Ikb Firmware
720S-13Ikb Firmware
B320-14Ikb Firmware
E42-80 Firmware
E52-80 Firmware
Flex 4-1470 Firmware

Affected Vendors

Hp Lenovo

References (2)

Vendor Advisory https://support.lenovo.com/us/en/solutions/LEN-20184
Vendor Advisory https://support.lenovo.com/us/en/solutions/LEN-20184
47
/ 100
moderate-risk
Severity 18/34 · Moderate
Exploitability 1/34 · Minimal
Exposure 28/34 · Critical