CVE-2018-9062
Medium
Description
In some Lenovo ThinkPad products, one BIOS region is not properly included in the checks, allowing injection of arbitrary code.
SeverityMedium
CVSS6.8
Exploit probability—
ProductLenovo Thinkpad L380 Firmware
PublishedJul 19, 2018
First seenJul 19, 2018
How to fix
Update
- lenovo thinkpad_l380_firmwarer0ret28w or later
- lenovo e42-80_firmware2wcn40ww or later
- lenovo e42-80_isk_firmware0zcn48ww or later
- lenovo e52-80_firmware2wcn40ww or later
- lenovo e52-80_isk_firmware0zcn48ww or later
- lenovo miix_720-12ikb_firmware3scn68ww or later
- lenovo v310-14ikb_firmware2wcn40ww or later
- lenovo v310-14isk_firmware0zcn48ww or later
- lenovo v310-15ikb_firmware2wcn40ww or later
- lenovo v310-15isk_firmware0zcn48ww or later
- lenovo v510-14ikb_firmware2wcn40ww or later
- lenovo v510-15ikb_firmware2wcn40ww or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| lenovo thinkpad_l380_firmware | v < r0ret28w | r0ret28w |
| lenovo e42-80_firmware | v < 2wcn40ww | 2wcn40ww |
| lenovo e42-80_isk_firmware | v < 0zcn48ww | 0zcn48ww |
| lenovo e52-80_firmware | v < 2wcn40ww | 2wcn40ww |
| lenovo e52-80_isk_firmware | v < 0zcn48ww | 0zcn48ww |
| lenovo miix_720-12ikb_firmware | v < 3scn68ww | 3scn68ww |
| lenovo v310-14ikb_firmware | v < 2wcn40ww | 2wcn40ww |
| lenovo v310-14isk_firmware | v < 0zcn48ww | 0zcn48ww |
| lenovo v310-15ikb_firmware | v < 2wcn40ww | 2wcn40ww |
| lenovo v310-15isk_firmware | v < 0zcn48ww | 0zcn48ww |
| lenovo v510-14ikb_firmware | v < 2wcn40ww | 2wcn40ww |
| lenovo v510-15ikb_firmware | v < 2wcn40ww | 2wcn40ww |
| lenovo thinkpad_e480_firmware | v < r0pet47w | r0pet47w |
| lenovo thinkpad_e580_firmware | v < r0pet47w | r0pet47w |
| lenovo thinkpad_l480_firmware | v < r0qet47w | r0qet47w |
| lenovo thinkpad_l580_firmware | v < r0qet47w | r0qet47w |
| lenovo thinkpad_p51_firmware | v < n1uet71w | n1uet71w |
| lenovo thinkpad_p51s_firmware | v < n1vet45w | n1vet45w |
| lenovo thinkpad_p52_firmware | v < n2cet28w | n2cet28w |
| lenovo thinkpad_p52s_firmware | v < n27et27w | n27et27w |
| lenovo thinkpad_p71_firmware | v < n1tet50w | n1tet50w |
| lenovo thinkpad_p72_firmware | v < n2cet28w | n2cet28w |
| lenovo thinkpad_t25_firmware | v < n1qet77w | n1qet77w |
| lenovo thinkpad_t470_firmware | v < n1qet77w | n1qet77w |
| lenovo thinkpad_t470p_firmware | v < r0fet44w | r0fet44w |
| lenovo thinkpad_t470s_firmware | v < n1wet49w | n1wet49w |
| lenovo thinkpad_t480_firmware | v < n24et41w | n24et41w |
| lenovo thinkpad_t480s_firmware | v < n22et48w | n22et48w |
| lenovo thinkpad_t570_firmware | v < n1vet45w | n1vet45w |
| lenovo thinkpad_t580_firmware | v < n27et27w | n27et27w |
| lenovo thinkpad_x380_yoga_firmware | v < r0set29w | r0set29w |
| lenovo thinkpad_yoga_11e_firmware | v < r0vet23w | r0vet23w |
| lenovo thinkpad_yoga_370_firmware | v < r0het48w | r0het48w |
| lenovo thinkpad_s1_firmware | v < r0het48w | r0het48w |
| lenovo thinkpad_x1_carbon_firmware | v < n1met49w, v < n23et52w | n1met49w, n23et52w |
| lenovo thinkpad_x1_tablet_firmware | v < n1oet45w, v < n1zet69w | n1oet45w, n1zet69w |
| lenovo thinkpad_x1_yoga_firmware | v < n1net42w, v < n25et38w | n1net42w, n25et38w |
| lenovo thinkpad_x270_firmware | v < r0iet53w | r0iet53w |
| lenovo thinkpad_x280_firmware | v < n20et33w | n20et33w |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.