MITRE is populating this ID because it was assigned prior to Lenovo becoming a CNA.
Priority MEDIUM 48CWE-120Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-120 and the CVSS impact.
Summary
MITRE is populating this ID because it was assigned prior to Lenovo becoming a CNA. A buffer overflow vulnerability was reported, (fixed and publicly disclosed in 2015) in the Lenovo Service Engine (LSE), affecting various versions of BIOS for Lenovo Notebooks, that could allow a remote user to execute arbitrary code on the system.
Why it matters now
EPSS 0.03688 89th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 56
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:lenovo:b50-10_firmware:*:*:*:*:*:*:*:* | before cccn13ww\(v1.02\) | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:b50-10:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:o:lenovo:flex_2_pro-15_firmware:*:*:*:*:*:*:*:* | before a9cn46ww | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:flex_2_pro-15:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:o:lenovo:edge_15_firmware:*:*:*:*:*:*:*:* | before a9cn46ww | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:edge_15:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:o:lenovo:edge_15_firmware:*:*:*:*:*:*:*:* | before b9cn17ww | Vulnerable | Lenovo |
| cpe:2.3:o:lenovo:flex_2_pro-15_firmware:*:*:*:*:*:*:*:* | before b9cn17ww | Vulnerable | Lenovo |
| cpe:2.3:o:lenovo:flex_3-1470_firmware:*:*:*:*:*:*:*:* | before bdcn30ww | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:flex_3-1470:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
- cpe:2.3:o:lenovo:b50-10_firmware:*:*:*:*:*:*:*:* Versions before cccn13ww\(v1.02\) Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:b50-10:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:o:lenovo:flex_2_pro-15_firmware:*:*:*:*:*:*:*:* Versions before a9cn46ww Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:flex_2_pro-15:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:o:lenovo:edge_15_firmware:*:*:*:*:*:*:*:* Versions before a9cn46ww Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:edge_15:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:o:lenovo:edge_15_firmware:*:*:*:*:*:*:*:* Versions before b9cn17ww Vulnerable ·Lenovo
- cpe:2.3:o:lenovo:flex_2_pro-15_firmware:*:*:*:*:*:*:*:* Versions before b9cn17ww Vulnerable ·Lenovo
- cpe:2.3:o:lenovo:flex_3-1470_firmware:*:*:*:*:*:*:*:* Versions before bdcn30ww Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:flex_3-1470:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
Show 46 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:lenovo:flex_3-1570_firmware:*:*:*:*:*:*:*:* | before bdcn30ww | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:flex_3-1570:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:o:lenovo:flex_3-1120_firmware:*:*:*:*:*:*:*:* | before c0cn25ww | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:flex_3-1120:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:o:lenovo:g40-80_firmware:*:*:*:*:*:*:*:* | before b0cn75ww | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:g40-80:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:o:lenovo:g50-80_firmware:*:*:*:*:*:*:*:* | before b0cn75ww | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:g50-80:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:o:lenovo:g50-80_touch_firmware:*:*:*:*:*:*:*:* | before b0cn75ww | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:g50-80_touch:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:o:lenovo:g50-80_touch_v3000_firmware:*:*:*:*:*:*:*:* | before b0cn75ww | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:g50-80_touch_v3000:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:o:lenovo:g40-80m_firmware:*:*:*:*:*:*:*:* | before cbcn75ww | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:g40-80m:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:o:lenovo:g50-80m_firmware:*:*:*:*:*:*:*:* | before cbcn75ww | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:g50-80m:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:o:lenovo:ideapad_100-14iby_firmware:*:*:*:*:*:*:*:* | before v1.02_\(cccn13ww\) | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:ideapad_100-14iby:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:o:lenovo:ideapad_100-15iby_firmware:*:*:*:*:*:*:*:* | before v1.02_\(cccn13ww\) | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:ideapad_100-15iby:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:o:lenovo:s21e_firmware:*:*:*:*:*:*:*:* | before c4cn14ww\(v1.04\) | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:s21e:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:o:lenovo:s41-70_firmware:*:*:*:*:*:*:*:* | before bdcn30ww | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:s41-70:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:o:lenovo:u41-70_firmware:*:*:*:*:*:*:*:* | before bdcn30ww | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:u41-70:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:o:lenovo:s435_firmware:*:*:*:*:*:*:*:* | before bbcn15ww\(v1.06\) | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:s435:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:o:lenovo:m40-35_firmware:*:*:*:*:*:*:*:* | before bbcn15ww\(v1.06\) | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:m40-35:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:o:lenovo:u31-70_firmware:*:*:*:*:*:*:*:* | before afcn30ww\(v2.02\) | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:u31-70:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:o:lenovo:yoga_3_14_firmware:*:*:*:*:*:*:*:* | before bacn33ww | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:yoga_3_14:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:o:lenovo:yoga_3_11_firmware:*:*:*:*:*:*:*:* | before b8cn30ww\(v2.08\) | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:yoga_3_11:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:o:lenovo:y40-80_firmware:*:*:*:*:*:*:*:* | before b5cn36ww\(v2.02\) | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:y40-80:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:o:lenovo:z41-70_firmware:*:*:*:*:*:*:*:* | before c2cn18ww\(v1.04\) | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:z41-70:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:o:lenovo:z51-70_firmware:*:*:*:*:*:*:*:* | before c2cn18ww\(v1.04\) | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:z51-70:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:o:lenovo:z70-80_firmware:*:*:*:*:*:*:*:* | before abcn75ww | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:z70-80:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:o:lenovo:g70-80_firmware:*:*:*:*:*:*:*:* | before abcn75ww | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:g70-80:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
- cpe:2.3:o:lenovo:flex_3-1570_firmware:*:*:*:*:*:*:*:* Versions before bdcn30ww Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:flex_3-1570:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:o:lenovo:flex_3-1120_firmware:*:*:*:*:*:*:*:* Versions before c0cn25ww Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:flex_3-1120:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:o:lenovo:g40-80_firmware:*:*:*:*:*:*:*:* Versions before b0cn75ww Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:g40-80:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:o:lenovo:g50-80_firmware:*:*:*:*:*:*:*:* Versions before b0cn75ww Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:g50-80:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:o:lenovo:g50-80_touch_firmware:*:*:*:*:*:*:*:* Versions before b0cn75ww Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:g50-80_touch:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:o:lenovo:g50-80_touch_v3000_firmware:*:*:*:*:*:*:*:* Versions before b0cn75ww Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:g50-80_touch_v3000:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:o:lenovo:g40-80m_firmware:*:*:*:*:*:*:*:* Versions before cbcn75ww Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:g40-80m:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:o:lenovo:g50-80m_firmware:*:*:*:*:*:*:*:* Versions before cbcn75ww Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:g50-80m:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:o:lenovo:ideapad_100-14iby_firmware:*:*:*:*:*:*:*:* Versions before v1.02_\(cccn13ww\) Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:ideapad_100-14iby:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:o:lenovo:ideapad_100-15iby_firmware:*:*:*:*:*:*:*:* Versions before v1.02_\(cccn13ww\) Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:ideapad_100-15iby:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:o:lenovo:s21e_firmware:*:*:*:*:*:*:*:* Versions before c4cn14ww\(v1.04\) Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:s21e:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:o:lenovo:s41-70_firmware:*:*:*:*:*:*:*:* Versions before bdcn30ww Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:s41-70:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:o:lenovo:u41-70_firmware:*:*:*:*:*:*:*:* Versions before bdcn30ww Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:u41-70:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:o:lenovo:s435_firmware:*:*:*:*:*:*:*:* Versions before bbcn15ww\(v1.06\) Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:s435:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:o:lenovo:m40-35_firmware:*:*:*:*:*:*:*:* Versions before bbcn15ww\(v1.06\) Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:m40-35:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:o:lenovo:u31-70_firmware:*:*:*:*:*:*:*:* Versions before afcn30ww\(v2.02\) Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:u31-70:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:o:lenovo:yoga_3_14_firmware:*:*:*:*:*:*:*:* Versions before bacn33ww Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:yoga_3_14:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:o:lenovo:yoga_3_11_firmware:*:*:*:*:*:*:*:* Versions before b8cn30ww\(v2.08\) Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:yoga_3_11:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:o:lenovo:y40-80_firmware:*:*:*:*:*:*:*:* Versions before b5cn36ww\(v2.02\) Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:y40-80:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:o:lenovo:z41-70_firmware:*:*:*:*:*:*:*:* Versions before c2cn18ww\(v1.04\) Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:z41-70:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:o:lenovo:z51-70_firmware:*:*:*:*:*:*:*:* Versions before c2cn18ww\(v1.04\) Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:z51-70:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:o:lenovo:z70-80_firmware:*:*:*:*:*:*:*:* Versions before abcn75ww Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:z70-80:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:o:lenovo:g70-80_firmware:*:*:*:*:*:*:*:* Versions before abcn75ww Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:g70-80:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2015-5684
- 2026-10-03 Alias added: GHSA-xp5w-3gmw-7xvj
References
Sources
- CVE-2015-5684 · CVE Program
- CVE-2015-5684 · NVD
- FIRST EPSS
- GHSA-xp5w-3gmw-7xvj · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences