Read the docs
TI-2018-06585 Aliases CVE-2018-9069GHSA-p7mj-q6cv-6qw2

BIOS Write Protection Race Condition

Priority LOW 27CWE-362Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
High
Impact type
—
Confidentiality · integrity · availability
None · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

In some Lenovo IdeaPad consumer notebook models, a race condition in the BIOS flash device locking mechanism is not adequately protected against, potentially allowing an attacker with administrator access to alter the contents of BIOS.

Why it matters now

EPSS 0.00532 45th percentileScored 2026-11-07
Fix Fixed IdeaPad (Lenovo Group LTD): various

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
LenovoIdeaPadvarious to before variousvariousPatch availableCNA
  • IdeaPad VendorLenovo Affected various to before various Fixed in various Patch available CNA

CPE configurations NVD · 136

CPEVersionsRoleVendor
cpe:2.3:o:hp:310s-14isk_firmware:*:*:*:*:*:*:*:*before 1.15VulnerableHewlett Packard Enterprise
cpe:2.3:h:hp:310s-14isk:-:*:*:*:*:*:*:*not specified by NVDRunning onHewlett Packard Enterprise
cpe:2.3:o:hp:320-15ikbra_firmware:*:*:*:*:*:*:*:*before 6jcn24wwVulnerableHewlett Packard Enterprise
cpe:2.3:h:hp:320-15ikbra:-:*:*:*:*:*:*:*not specified by NVDRunning onHewlett Packard Enterprise
cpe:2.3:o:hp:320-15ikbrn_firmware:*:*:*:*:*:*:*:*before 6jcn24wwVulnerableHewlett Packard Enterprise
cpe:2.3:h:hp:320-15ikbrn:-:*:*:*:*:*:*:*not specified by NVDRunning onHewlett Packard Enterprise
cpe:2.3:o:hp:320-15ikbrn_touch_firmware:*:*:*:*:*:*:*:*before 6jcn24wwVulnerableHewlett Packard Enterprise
cpe:2.3:h:hp:320-15ikbrn_touch:-:*:*:*:*:*:*:*not specified by NVDRunning onHewlett Packard Enterprise
cpe:2.3:h:hp:320-17ikbrn:*:*:*:*:*:*:*:*before 2.09VulnerableHewlett Packard Enterprise
cpe:2.3:h:hp:320-17ikbrn:-:*:*:*:*:*:*:*not specified by NVDRunning onHewlett Packard Enterprise
Show 126 more CPE
CPEVersionsRoleVendor
cpe:2.3:h:hp:320s-14ikb:*:*:*:*:*:*:*:*before 2.09VulnerableHewlett Packard Enterprise
cpe:2.3:h:hp:320s-14ikb:-:*:*:*:*:*:*:*not specified by NVDRunning onHewlett Packard Enterprise
cpe:2.3:o:hp:320s-15ikb_firmware:*:*:*:*:*:*:*:*before 2.09VulnerableHewlett Packard Enterprise
cpe:2.3:h:hp:320s-15ikb:-:*:*:*:*:*:*:*not specified by NVDRunning onHewlett Packard Enterprise
cpe:2.3:o:hp:320s-15isk_firmware:*:*:*:*:*:*:*:*before 2wcn38wwVulnerableHewlett Packard Enterprise
cpe:2.3:h:hp:320s-15isk:-:*:*:*:*:*:*:*not specified by NVDRunning onHewlett Packard Enterprise
cpe:2.3:o:hp:510s-14isk_firmware:*:*:*:*:*:*:*:*before 1.15VulnerableHewlett Packard Enterprise
cpe:2.3:h:hp:510s-14isk:-:*:*:*:*:*:*:*not specified by NVDRunning onHewlett Packard Enterprise
cpe:2.3:o:hp:520-15ikbrn_firmware:*:*:*:*:*:*:*:*before 6jcn26wwVulnerableHewlett Packard Enterprise
cpe:2.3:h:hp:520-15ikbrn:-:*:*:*:*:*:*:*not specified by NVDRunning onHewlett Packard Enterprise
cpe:2.3:o:hp:520s-14ikb_firmware:*:*:*:*:*:*:*:*before 2.09VulnerableHewlett Packard Enterprise
cpe:2.3:h:hp:520s-14ikb:-:*:*:*:*:*:*:*not specified by NVDRunning onHewlett Packard Enterprise
cpe:2.3:o:hp:710s_plus-13ikb_16g_firmware:*:*:*:*:*:*:*:*before 2.55VulnerableHewlett Packard Enterprise
cpe:2.3:h:hp:710s_plus-13ikb_16g:-:*:*:*:*:*:*:*not specified by NVDRunning onHewlett Packard Enterprise
cpe:2.3:o:hp:710s_plus-3ikb_firmware:*:*:*:*:*:*:*:*before 2.55VulnerableHewlett Packard Enterprise
cpe:2.3:h:hp:710s_plus-3ikb:-:*:*:*:*:*:*:*not specified by NVDRunning onHewlett Packard Enterprise
cpe:2.3:o:hp:xiaoxinair13ikbpro_firmware:*:*:*:*:*:*:*:*before 2.55VulnerableHewlett Packard Enterprise
cpe:2.3:h:hp:xiaoxinair13ikbpro:-:*:*:*:*:*:*:*not specified by NVDRunning onHewlett Packard Enterprise
cpe:2.3:o:hp:710s_plus_touch-13ikb_firmware:*:*:*:*:*:*:*:*before 2.55VulnerableHewlett Packard Enterprise
cpe:2.3:h:hp:710s_plus_touch-13ikb:-:*:*:*:*:*:*:*not specified by NVDRunning onHewlett Packard Enterprise
cpe:2.3:o:hp:720s-13ikb_firmware:*:*:*:*:*:*:*:*before 5scn38wwVulnerableHewlett Packard Enterprise
cpe:2.3:h:hp:720s-13ikb:-:*:*:*:*:*:*:*not specified by NVDRunning onHewlett Packard Enterprise
cpe:2.3:o:hp:b320-14ikb_firmware:-:*:*:*:*:*:*:*not specified by NVDVulnerableHewlett Packard Enterprise
cpe:2.3:h:hp:b320-14ikb:-:*:*:*:*:*:*:*not specified by NVDRunning onHewlett Packard Enterprise
cpe:2.3:o:lenovo:e42-80_firmware:*:*:*:*:*:*:*:*before 2wcn38wwVulnerableLenovo
cpe:2.3:h:hp:e42-80:-:*:*:*:*:*:*:*not specified by NVDRunning onHewlett Packard Enterprise
cpe:2.3:o:lenovo:e52-80_firmware:*:*:*:*:*:*:*:*before 2wcn38wwVulnerableLenovo
cpe:2.3:h:hp:e52-80:-:*:*:*:*:*:*:*not specified by NVDRunning onHewlett Packard Enterprise
cpe:2.3:o:hp:flex_4-1470_firmware:*:*:*:*:*:*:*:*before 1.15VulnerableHewlett Packard Enterprise
cpe:2.3:h:hp:flex_4-1470:-:*:*:*:*:*:*:*not specified by NVDRunning onHewlett Packard Enterprise
cpe:2.3:o:hp:flex_5-1470_firmware:*:*:*:*:*:*:*:*before 2.09VulnerableHewlett Packard Enterprise
cpe:2.3:h:hp:flex_5-1470:-:*:*:*:*:*:*:*not specified by NVDRunning onHewlett Packard Enterprise
cpe:2.3:o:hp:flex_5-1570_firmware:*:*:*:*:*:*:*:*before 2.09VulnerableHewlett Packard Enterprise
cpe:2.3:h:hp:flex_5-1570:-:*:*:*:*:*:*:*not specified by NVDRunning onHewlett Packard Enterprise
cpe:2.3:o:hp:ideapad_2in1_14_firmware:-:*:*:*:*:*:*:*not specified by NVDVulnerableHewlett Packard Enterprise
cpe:2.3:h:hp:ideapad_2in1_14:-:*:*:*:*:*:*:*not specified by NVDRunning onHewlett Packard Enterprise
cpe:2.3:o:hp:lenovo_ideapad_320-14ikb\(i\+a\)_firmware:-:*:*:*:*:*:*:*not specified by NVDVulnerableHewlett Packard Enterprise
cpe:2.3:h:hp:lenovo_ideapad_320-14ikb\(i\+a\):-:*:*:*:*:*:*:*not specified by NVDRunning onHewlett Packard Enterprise
cpe:2.3:o:hp:lenovo_ideapad_320-14ikb\(i\+n\)_firmware:-:*:*:*:*:*:*:*not specified by NVDVulnerableHewlett Packard Enterprise
cpe:2.3:h:hp:lenovo_ideapad_320-14ikb\(i\+n\):-:*:*:*:*:*:*:*not specified by NVDRunning onHewlett Packard Enterprise
cpe:2.3:o:hp:lenovo_ideapad_320-15abr_firmware:-:*:*:*:*:*:*:*not specified by NVDVulnerableHewlett Packard Enterprise
cpe:2.3:h:hp:lenovo_ideapad_320-15abr:-:*:*:*:*:*:*:*not specified by NVDRunning onHewlett Packard Enterprise
cpe:2.3:o:hp:lenovo_ideapad_320-15ikb\(i\+n\)_firmware:-:*:*:*:*:*:*:*not specified by NVDVulnerableHewlett Packard Enterprise
cpe:2.3:h:hp:lenovo_ideapad_320-15ikb\(i\+n\):-:*:*:*:*:*:*:*not specified by NVDRunning onHewlett Packard Enterprise
cpe:2.3:o:hp:lenovo_ideapad_320s-14ikbr_firmware:-:*:*:*:*:*:*:*not specified by NVDVulnerableHewlett Packard Enterprise
cpe:2.3:h:hp:lenovo_ideapad_320s-14ikbr:-:*:*:*:*:*:*:*not specified by NVDRunning onHewlett Packard Enterprise
cpe:2.3:o:hp:lenovo_ideapad_320s-15ikbr_firmware:-:*:*:*:*:*:*:*not specified by NVDVulnerableHewlett Packard Enterprise
cpe:2.3:h:hp:lenovo_ideapad_320s-15ikbr:-:*:*:*:*:*:*:*not specified by NVDRunning onHewlett Packard Enterprise
cpe:2.3:o:hp:lenovo_ideapad_520s-14ikbr_firmware:-:*:*:*:*:*:*:*not specified by NVDVulnerableHewlett Packard Enterprise
cpe:2.3:h:hp:lenovo_ideapad_520s-14ikbr:-:*:*:*:*:*:*:*not specified by NVDRunning onHewlett Packard Enterprise
cpe:2.3:o:hp:lenovo_ideapad_720s-14ikb_firmware:*:*:*:*:*:*:*:*before 6jcn26wwVulnerableHewlett Packard Enterprise
cpe:2.3:h:hp:lenovo_ideapad_720s-14ikb:-:*:*:*:*:*:*:*not specified by NVDRunning onHewlett Packard Enterprise
cpe:2.3:o:hp:lenovo_ideapad_flex_5-1470_firmware:*:*:*:*:*:*:*:*before 6jcn26wwVulnerableHewlett Packard Enterprise
cpe:2.3:h:hp:lenovo_ideapad_flex_5-1470:-:*:*:*:*:*:*:*not specified by NVDRunning onHewlett Packard Enterprise
cpe:2.3:o:hp:lenovo_ideapad_flex_5-1570_firmware:*:*:*:*:*:*:*:*before 6jcn26wwVulnerableHewlett Packard Enterprise
cpe:2.3:h:hp:lenovo_ideapad_flex_5-1570:-:*:*:*:*:*:*:*not specified by NVDRunning onHewlett Packard Enterprise
cpe:2.3:o:hp:lenovo_ideapad_y520-15ikbn_firmware:-:*:*:*:*:*:*:*not specified by NVDVulnerableHewlett Packard Enterprise
cpe:2.3:h:hp:lenovo_ideapad_y520-15ikbn:-:*:*:*:*:*:*:*not specified by NVDRunning onHewlett Packard Enterprise
cpe:2.3:o:hp:lenovo_tianyi_310-14ikb_firmware:-:*:*:*:*:*:*:*not specified by NVDVulnerableHewlett Packard Enterprise
cpe:2.3:h:hp:lenovo_tianyi_310-14ikb:-:*:*:*:*:*:*:*not specified by NVDRunning onHewlett Packard Enterprise
cpe:2.3:o:hp:lenovo_tianyi_310-15ikb_firmware:-:*:*:*:*:*:*:*not specified by NVDVulnerableHewlett Packard Enterprise
cpe:2.3:h:hp:lenovo_tianyi_310-15ikb:-:*:*:*:*:*:*:*not specified by NVDRunning onHewlett Packard Enterprise
cpe:2.3:o:hp:lenovo_y520-15ikba_firmware:*:*:*:*:*:*:*:*before 5jcn25wwVulnerableHewlett Packard Enterprise
cpe:2.3:h:hp:lenovo_y520-15ikba:-:*:*:*:*:*:*:*not specified by NVDRunning onHewlett Packard Enterprise
cpe:2.3:o:hp:lenovo_y520-15ikbm_firmware:*:*:*:*:*:*:*:*before 5jcn25wwVulnerableHewlett Packard Enterprise
cpe:2.3:h:hp:lenovo_y520-15ikbm:-:*:*:*:*:*:*:*not specified by NVDRunning onHewlett Packard Enterprise
cpe:2.3:o:hp:lenovo_yoga_520-14ikb_firmware:*:*:*:*:*:*:*:*before 6jcn26wwVulnerableHewlett Packard Enterprise
cpe:2.3:h:hp:lenovo_yoga_520-14ikb:-:*:*:*:*:*:*:*not specified by NVDRunning onHewlett Packard Enterprise
cpe:2.3:o:hp:lenovo_yoga_520-15ikb_firmware:*:*:*:*:*:*:*:*before 6jcn26wwVulnerableHewlett Packard Enterprise
cpe:2.3:h:hp:lenovo_yoga_520-15ikb:-:*:*:*:*:*:*:*not specified by NVDRunning onHewlett Packard Enterprise
cpe:2.3:h:hp:miix_720-12ikb:*:*:*:*:*:*:*:*before 3scn66wwVulnerableHewlett Packard Enterprise
cpe:2.3:h:hp:miix_720-12ikb:-:*:*:*:*:*:*:*not specified by NVDRunning onHewlett Packard Enterprise
cpe:2.3:o:hp:nano110-14ikb_firmware:-:*:*:*:*:*:*:*not specified by NVDVulnerableHewlett Packard Enterprise
cpe:2.3:h:hp:nano110-14ikb:-:*:*:*:*:*:*:*not specified by NVDRunning onHewlett Packard Enterprise
cpe:2.3:o:hp:nano110-15ikb_firmware:*:*:*:*:*:*:*:*before 5xcn24wwVulnerableHewlett Packard Enterprise
cpe:2.3:h:hp:nano110-15ikb:-:*:*:*:*:*:*:*not specified by NVDRunning onHewlett Packard Enterprise
cpe:2.3:o:hp:rescuer_r720-15ikbm_firmware:*:*:*:*:*:*:*:*before 5xcn24wwVulnerableHewlett Packard Enterprise
cpe:2.3:h:hp:rescuer_r720-15ikbm:-:*:*:*:*:*:*:*not specified by NVDRunning onHewlett Packard Enterprise
cpe:2.3:o:hp:rescuer_y520-15ikbm_firmware:*:*:*:*:*:*:*:*before 5xcn24wwVulnerableHewlett Packard Enterprise
cpe:2.3:h:hp:rescuer_y520-15ikbm:-:*:*:*:*:*:*:*not specified by NVDRunning onHewlett Packard Enterprise
cpe:2.3:o:lenovo:v310-14ikb_firmware:*:*:*:*:*:*:*:*before 2wcn38wwVulnerableLenovo
cpe:2.3:h:hp:v310-14ikb:-:*:*:*:*:*:*:*not specified by NVDRunning onHewlett Packard Enterprise
cpe:2.3:o:lenovo:v310-14isk_firmware:*:*:*:*:*:*:*:*before 4.07VulnerableLenovo
cpe:2.3:h:hp:v310-14isk:-:*:*:*:*:*:*:*not specified by NVDRunning onHewlett Packard Enterprise
cpe:2.3:o:lenovo:v310-15ikb_firmware:*:*:*:*:*:*:*:*before 2wcn38wwVulnerableLenovo
cpe:2.3:h:hp:v310-15ikb:-:*:*:*:*:*:*:*not specified by NVDRunning onHewlett Packard Enterprise
cpe:2.3:o:lenovo:v310-15isk_firmware:*:*:*:*:*:*:*:*before 0zcn47wwVulnerableLenovo
cpe:2.3:h:hp:v310-15isk:-:*:*:*:*:*:*:*not specified by NVDRunning onHewlett Packard Enterprise
cpe:2.3:o:hp:v330-14ikb_firmware:*:*:*:*:*:*:*:*before 4.07VulnerableHewlett Packard Enterprise
cpe:2.3:h:hp:v330-14ikb:-:*:*:*:*:*:*:*not specified by NVDRunning onHewlett Packard Enterprise
cpe:2.3:o:hp:v330-14isk_firmware:*:*:*:*:*:*:*:*before 4.07VulnerableHewlett Packard Enterprise
cpe:2.3:h:hp:v330-14isk:-:*:*:*:*:*:*:*not specified by NVDRunning onHewlett Packard Enterprise
cpe:2.3:o:lenovo:v510-14ikb_firmware:*:*:*:*:*:*:*:*before 2wcn38wwVulnerableLenovo
cpe:2.3:h:hp:v510-14ikb:-:*:*:*:*:*:*:*not specified by NVDRunning onHewlett Packard Enterprise
cpe:2.3:o:lenovo:v510-15ikb_firmware:*:*:*:*:*:*:*:*before 2wcn38wwVulnerableLenovo
cpe:2.3:h:hp:v510-15ikb:-:*:*:*:*:*:*:*not specified by NVDRunning onHewlett Packard Enterprise
cpe:2.3:o:hp:yoga_310-11iap_firmware:*:*:*:*:*:*:*:*before 6.7VulnerableHewlett Packard Enterprise
cpe:2.3:h:hp:yoga_310-11iap:-:*:*:*:*:*:*:*not specified by NVDRunning onHewlett Packard Enterprise
cpe:2.3:o:hp:yoga_510-14isk_firmware:*:*:*:*:*:*:*:*before 1.15VulnerableHewlett Packard Enterprise
cpe:2.3:h:hp:yoga_510-14isk:-:*:*:*:*:*:*:*not specified by NVDRunning onHewlett Packard Enterprise
cpe:2.3:o:hp:yoga_720-13ikb_firmware:*:*:*:*:*:*:*:*before 2.05VulnerableHewlett Packard Enterprise
cpe:2.3:h:hp:yoga_720-13ikb:-:*:*:*:*:*:*:*not specified by NVDRunning onHewlett Packard Enterprise
cpe:2.3:o:hp:yoga_720-13ikbr_firmware:*:*:*:*:*:*:*:*before 2.07VulnerableHewlett Packard Enterprise
cpe:2.3:h:hp:yoga_720-13ikbr:-:*:*:*:*:*:*:*not specified by NVDRunning onHewlett Packard Enterprise
cpe:2.3:o:hp:yoga_720-15ikb_firmware:*:*:*:*:*:*:*:*before 2.05VulnerableHewlett Packard Enterprise
cpe:2.3:h:hp:yoga_720-15ikb:-:*:*:*:*:*:*:*not specified by NVDRunning onHewlett Packard Enterprise
cpe:2.3:o:hp:lenovo_v720-14_firmware:*:*:*:*:*:*:*:*before 2.12VulnerableHewlett Packard Enterprise
cpe:2.3:h:hp:lenovo_v720-14:-:*:*:*:*:*:*:*not specified by NVDRunning onHewlett Packard Enterprise
cpe:2.3:o:hp:7000_u42_firmware:*:*:*:*:*:*:*:*before 2.09VulnerableHewlett Packard Enterprise
cpe:2.3:h:hp:7000_u42:-:*:*:*:*:*:*:*not specified by NVDRunning onHewlett Packard Enterprise
cpe:2.3:o:hp:7000-15_u42_firmware:*:*:*:*:*:*:*:*before 2.09VulnerableHewlett Packard Enterprise
cpe:2.3:h:hp:7000-15_u42:-:*:*:*:*:*:*:*not specified by NVDRunning onHewlett Packard Enterprise
cpe:2.3:o:hp:r720-15ikba_firmware:*:*:*:*:*:*:*:*before 5jcn25wwVulnerableHewlett Packard Enterprise
cpe:2.3:h:hp:r720-15ikba:-:*:*:*:*:*:*:*not specified by NVDRunning onHewlett Packard Enterprise
cpe:2.3:o:hp:y520-15ikba_firmware:*:*:*:*:*:*:*:*before 5jcn25wwVulnerableHewlett Packard Enterprise
cpe:2.3:h:hp:y520-15ikba:-:*:*:*:*:*:*:*not specified by NVDRunning onHewlett Packard Enterprise
cpe:2.3:o:hp:r720-15ikbn_firmware:*:*:*:*:*:*:*:*before 4gcn38wwVulnerableHewlett Packard Enterprise
cpe:2.3:h:hp:r720-15ikbn:-:*:*:*:*:*:*:*not specified by NVDRunning onHewlett Packard Enterprise
cpe:2.3:o:hp:y520-15ikbn_firmware:*:*:*:*:*:*:*:*before 4gcn38wwVulnerableHewlett Packard Enterprise
cpe:2.3:h:hp:y520-15ikbn:-:*:*:*:*:*:*:*not specified by NVDRunning onHewlett Packard Enterprise
cpe:2.3:o:hp:y720-15ikb_firmware:*:*:*:*:*:*:*:*before 4gcn38wwVulnerableHewlett Packard Enterprise
cpe:2.3:h:hp:y720-15ikb:-:*:*:*:*:*:*:*not specified by NVDRunning onHewlett Packard Enterprise
cpe:2.3:o:hp:lenovo_y720-15ikb_firmware:*:*:*:*:*:*:*:*before 4gcn38wwVulnerableHewlett Packard Enterprise
cpe:2.3:h:hp:lenovo_y720-15ikb:-:*:*:*:*:*:*:*not specified by NVDRunning onHewlett Packard Enterprise
cpe:2.3:o:hp:e43-80_kbl_firmware:*:*:*:*:*:*:*:*before 4.07VulnerableHewlett Packard Enterprise
cpe:2.3:h:hp:e43-80_kbl:-:*:*:*:*:*:*:*not specified by NVDRunning onHewlett Packard Enterprise

Remediation

  • Fix · CNA IdeaPad (Lenovo Group LTD) Fixed in various

Timeline

  1. 2026-10-02 Threatist record created from CVE-2018-9069
  2. 2026-10-03 Alias added: GHSA-p7mj-q6cv-6qw2

References

  • TI-2019-04387 ThinkPad T460p and T470p BIOS Tamper Mechanism CVSS 3.1CRITICAL 9.8
  • TI-2018-06578 BIOS Modules Unprotected by Intel Boot Guard Vulnerable to Physical Attack CVSS 3.1MEDIUM 6.8
  • TI-2020-06726 A potential vulnerability in the SMI callback function used in the Legacy SD driver in… CVSS 3.1MEDIUM 6.7
  • TI-2020-06725 A potential vulnerability in the SMI callback function used in the Legacy USB driver in… CVSS 3.1MEDIUM 6.7
  • TI-2019-04373 A potential vulnerability in the SMI callback function used in Legacy USB driver using… CVSS 3.1MEDIUM 6.4
  • TI-2019-04371 A potential vulnerability in the SMI callback function used in the Legacy USB driver… CVSS 3.1MEDIUM 6.4

Sources