CVE-2018-9069

published 2018-10-02

CVE-2018-9069: In some Lenovo IdeaPad consumer notebook models, a race condition in the BIOS flash device locking mechanism is not adequately protected against, potentially…

Priority P4 26 medium 5.9 CVSS 3.1

AV N AC H PR H UI N S U C N I H A H

In some Lenovo IdeaPad consumer notebook models, a race condition in the BIOS flash device locking mechanism is not adequately protected against, potentially allowing an attacker with administrator access to alter the contents of BIOS.

Affected

56 ranges · showing 25

Vendor	Product	Version range	Fixed in
hp	310s-14isk_firmware	< 1.15	1.15
hp	320-15ikbra_firmware	< 6jcn24ww	6jcn24ww
hp	320-15ikbrn_firmware	< 6jcn24ww	6jcn24ww
hp	320-15ikbrn_touch_firmware	< 6jcn24ww	6jcn24ww
hp	320-17ikbrn	< 2.09	2.09
hp	320s-14ikb	< 2.09	2.09
hp	320s-15ikb_firmware	< 2.09	2.09
hp	320s-15isk_firmware	< 2wcn38ww	2wcn38ww
hp	510s-14isk_firmware	< 1.15	1.15
hp	520-15ikbrn_firmware	< 6jcn26ww	6jcn26ww
hp	520s-14ikb_firmware	< 2.09	2.09
hp	7000-15_u42_firmware	< 2.09	2.09
hp	7000_u42_firmware	< 2.09	2.09
hp	710s_plus-13ikb_16g_firmware	< 2.55	2.55
hp	710s_plus-3ikb_firmware	< 2.55	2.55
hp	710s_plus_touch-13ikb_firmware	< 2.55	2.55
hp	720s-13ikb_firmware	< 5scn38ww	5scn38ww
hp	e43-80_kbl_firmware	< 4.07	4.07
hp	flex_4-1470_firmware	< 1.15	1.15
hp	flex_5-1470_firmware	< 2.09	2.09
hp	flex_5-1570_firmware	< 2.09	2.09
hp	lenovo_ideapad_720s-14ikb_firmware	< 6jcn26ww	6jcn26ww
hp	lenovo_ideapad_flex_5-1470_firmware	< 6jcn26ww	6jcn26ww
hp	lenovo_ideapad_flex_5-1570_firmware	< 6jcn26ww	6jcn26ww
hp	lenovo_v720-14_firmware	< 2.12	2.12

CVSS provenance

nvd v3.1 5.9 MEDIUM CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:H

nvd v2.0 7.0 HIGH AV:N/AC:M/Au:S/C:N/I:P/A:C

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-362