Read the docs
TI-2018-06601 Aliases CVE-2018-9085GHSA-r2wg-439c-8pcq

Missing System x Flash Memory Write Protection Lock Bit

Priority LOW 24CWE-276Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · High · None
Fix status
Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA.

Summary

A write protection lock bit was left unset after boot on an older generation of Lenovo and IBM System x servers, potentially allowing an attacker with administrator access to modify the subset of flash memory containing Intel Server Platform Services (SPS) and the system Flash Descriptors.

Why it matters now

EPSS 0.00664 51st percentileScored 2026-11-07
Fix Fixed System x UEFI (Lenovo): variesSystem x UEFI (IBM): varies

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
LenovoSystem x UEFIbefore variesvariesPatch availableCNA
IBMSystem x UEFIbefore variesvariesPatch availableCNA
  • System x UEFI VendorLenovo Affected before varies Fixed in varies Patch available CNA
  • System x UEFI VendorIBM Affected before varies Fixed in varies Patch available CNA

CPE configurations NVD · 57

CPEVersionsRoleVendor
cpe:2.3:o:lenovo:flex_system_x240_m4_firmware:*:*:*:*:*:*:*:*before a3e122bVulnerableLenovo
cpe:2.3:h:lenovo:flex_system_x240_m4:-:*:*:*:*:*:*:*not specified by NVDRunning onLenovo
cpe:2.3:o:lenovo:flex_system_x440_m4_firmware:*:*:*:*:*:*:*:*before cge122bVulnerableLenovo
cpe:2.3:h:lenovo:flex_system_x440_m4:-:*:*:*:*:*:*:*not specified by NVDRunning onLenovo
cpe:2.3:o:lenovo:system_x3750_m4_firmware:*:*:*:*:*:*:*:*before a5e124bVulnerableLenovo
cpe:2.3:h:lenovo:system_x3750_m4:-:*:*:*:*:*:*:*not specified by NVDRunning onLenovo
cpe:2.3:o:ibm:bladecenter_hs23_firmware:*:*:*:*:*:*:*:*before tke160cVulnerableIBM
cpe:2.3:h:ibm:bladecenter:hs23:-:*:*:*:*:*:*hs23Running onIBM
cpe:2.3:o:ibm:bladecenter_hs23e_firmware:*:*:*:*:*:*:*:*before ahe160cVulnerableIBM
cpe:2.3:h:ibm:bladecenter:hs23e:-:*:*:*:*:*:*hs23eRunning onIBM
  • cpe:2.3:o:lenovo:flex_system_x240_m4_firmware:*:*:*:*:*:*:*:* Versions before a3e122b Vulnerable ·Lenovo
  • cpe:2.3:h:lenovo:flex_system_x240_m4:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
  • cpe:2.3:o:lenovo:flex_system_x440_m4_firmware:*:*:*:*:*:*:*:* Versions before cge122b Vulnerable ·Lenovo
  • cpe:2.3:h:lenovo:flex_system_x440_m4:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
  • cpe:2.3:o:lenovo:system_x3750_m4_firmware:*:*:*:*:*:*:*:* Versions before a5e124b Vulnerable ·Lenovo
  • cpe:2.3:h:lenovo:system_x3750_m4:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
  • cpe:2.3:o:ibm:bladecenter_hs23_firmware:*:*:*:*:*:*:*:* Versions before tke160c Vulnerable ·IBM
  • cpe:2.3:h:ibm:bladecenter:hs23:-:*:*:*:*:*:* Versions hs23 Running on ·IBM
  • cpe:2.3:o:ibm:bladecenter_hs23e_firmware:*:*:*:*:*:*:*:* Versions before ahe160c Vulnerable ·IBM
  • cpe:2.3:h:ibm:bladecenter:hs23e:-:*:*:*:*:*:* Versions hs23e Running on ·IBM
Show 47 more CPE
CPEVersionsRoleVendor
cpe:2.3:o:ibm:flex_system_x220_m4_firmware:*:*:*:*:*:*:*:*before kse158cVulnerableIBM
cpe:2.3:h:ibm:flex_system_x220:-:*:*:*:*:*:*:*not specified by NVDRunning onIBM
cpe:2.3:o:ibm:flex_system_x222_m4_firmware:*:*:*:*:*:*:*:*before cce160cVulnerableIBM
cpe:2.3:h:ibm:flex_system_x222_m4:-:*:*:*:*:*:*:*not specified by NVDRunning onIBM
cpe:2.3:o:ibm:flex_system_x240_m4_firmware:*:*:*:*:*:*:*:*before ahe160cVulnerableIBM
cpe:2.3:h:ibm:flex_system_x240_m4:-:*:*:*:*:*:*:*not specified by NVDRunning onIBM
cpe:2.3:o:ibm:flex_system_x280_x6_firmware:*:*:*:*:*:*:*:*before n3e132wVulnerableIBM
cpe:2.3:h:ibm:flex_system_x280_x6:-:*:*:*:*:*:*:*not specified by NVDRunning onIBM
cpe:2.3:o:ibm:flex_system_x440_m4_firmware:*:*:*:*:*:*:*:*before cne162dVulnerableIBM
cpe:2.3:h:ibm:flex_system_x440_m4:-:*:*:*:*:*:*:*not specified by NVDRunning onIBM
cpe:2.3:o:ibm:flex_system_x480_x6_firmware:*:*:*:*:*:*:*:*before n3e132wVulnerableIBM
cpe:2.3:h:ibm:flex_system_x480_x6:-:*:*:*:*:*:*:*not specified by NVDRunning onIBM
cpe:2.3:o:ibm:flex_system_x880_x6_firmware:*:*:*:*:*:*:*:*before n2e130eVulnerableIBM
cpe:2.3:h:ibm:flex_system_x880_x6:-:*:*:*:*:*:*:*not specified by NVDRunning onIBM
cpe:2.3:o:ibm:idataplex_dx360_m4_firmware:*:*:*:*:*:*:*:*before fhe120dVulnerableIBM
cpe:2.3:h:ibm:idataplex_dx360_m4_:-:*:*:*:*:*:*:*not specified by NVDRunning onIBM
cpe:2.3:o:ibm:idataplex_dx360_m4_water_cooled_firmware:*:*:*:*:*:*:*:*before fhe120dVulnerableIBM
cpe:2.3:o:ibm:system_x3100_m4_firmware:*:*:*:*:*:*:*:*before jqe184cVulnerableIBM
cpe:2.3:h:ibm:system_x3100_m4:*:*:*:*:*:*:*:*all versionsRunning onIBM
cpe:2.3:o:ibm:system_x3100_m5_firmware:*:*:*:*:*:*:*:*before j9e134cVulnerableIBM
cpe:2.3:h:ibm:system_x3100_m5:*:*:*:*:*:*:*:*all versionsRunning onIBM
cpe:2.3:o:ibm:system_x3250_m4_firmware:*:*:*:*:*:*:*:*before jqe184cVulnerableIBM
cpe:2.3:h:ibm:system_x3250_m4:*:*:*:*:*:*:*:*all versionsRunning onIBM
cpe:2.3:o:ibm:system_x3250_m5_firmware:*:*:*:*:*:*:*:*before jue134cVulnerableIBM
cpe:2.3:h:ibm:system_x3250_m5:*:*:*:*:*:*:*:*all versionsRunning onIBM
cpe:2.3:o:ibm:system_x3300_m4_firmware:*:*:*:*:*:*:*:*before yae156cVulnerableIBM
cpe:2.3:h:ibm:system_x3300_m4:*:*:*:*:*:*:*:*all versionsRunning onIBM
cpe:2.3:o:ibm:system_x3500_m4_firmware:*:*:*:*:*:*:*:*before y5e158cVulnerableIBM
cpe:2.3:h:ibm:system_x3500_m4:*:*:*:*:*:*:*:*all versionsRunning onIBM
cpe:2.3:o:ibm:system_x3530_m4_firmware:*:*:*:*:*:*:*:*before bee164cVulnerableIBM
cpe:2.3:h:ibm:system_x3530_m4:*:*:*:*:*:*:*:*all versionsRunning onIBM
cpe:2.3:o:ibm:system_x3550_m4_firmware:*:*:*:*:*:*:*:*before d7e166dVulnerableIBM
cpe:2.3:h:ibm:system_x3550_m4:*:*:*:*:*:*:*:*all versionsRunning onIBM
cpe:2.3:o:ibm:system_x3630_m4_firmware:*:*:*:*:*:*:*:*before vve162cVulnerableIBM
cpe:2.3:h:ibm:system_x3630_m4:*:*:*:*:*:*:*:*all versionsRunning onIBM
cpe:2.3:o:ibm:system_x3650_m4_firmware:*:*:*:*:*:*:*:*before vve160cVulnerableIBM
cpe:2.3:h:ibm:system_x3650_m4:*:*:*:*:*:*:*:*all versionsRunning onIBM
cpe:2.3:o:ibm:system_x3650_m4_bd_firmware:*:*:*:*:*:*:*:*before vve160cVulnerableIBM
cpe:2.3:h:ibm:system_x3650_m4_bd:*:*:*:*:*:*:*:*all versionsRunning onIBM
cpe:2.3:o:ibm:system_x3650_m4_hd_firmware:*:*:*:*:*:*:*:*before vve160cVulnerableIBM
cpe:2.3:h:ibm:system_x3650_m4_hd:*:*:*:*:*:*:*:*all versionsRunning onIBM
cpe:2.3:o:ibm:system_x3750_m4_firmware:*:*:*:*:*:*:*:*before koe160cVulnerableIBM
cpe:2.3:h:ibm:system_x3750_m4:*:*:*:*:*:*:*:*all versionsRunning onIBM
cpe:2.3:o:ibm:system_x3850_x6_firmware:*:*:*:*:*:*:*:*before a8e128cVulnerableIBM
cpe:2.3:h:ibm:system_x3850_x6:*:*:*:*:*:*:*:*all versionsRunning onIBM
cpe:2.3:o:ibm:system_x3950_x6_firmware:*:*:*:*:*:*:*:*before bee164cVulnerableIBM
cpe:2.3:h:ibm:system_x3950_x6:*:*:*:*:*:*:*:*all versionsRunning onIBM
  • cpe:2.3:o:ibm:flex_system_x220_m4_firmware:*:*:*:*:*:*:*:* Versions before kse158c Vulnerable ·IBM
  • cpe:2.3:h:ibm:flex_system_x220:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·IBM
  • cpe:2.3:o:ibm:flex_system_x222_m4_firmware:*:*:*:*:*:*:*:* Versions before cce160c Vulnerable ·IBM
  • cpe:2.3:h:ibm:flex_system_x222_m4:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·IBM
  • cpe:2.3:o:ibm:flex_system_x240_m4_firmware:*:*:*:*:*:*:*:* Versions before ahe160c Vulnerable ·IBM
  • cpe:2.3:h:ibm:flex_system_x240_m4:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·IBM
  • cpe:2.3:o:ibm:flex_system_x280_x6_firmware:*:*:*:*:*:*:*:* Versions before n3e132w Vulnerable ·IBM
  • cpe:2.3:h:ibm:flex_system_x280_x6:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·IBM
  • cpe:2.3:o:ibm:flex_system_x440_m4_firmware:*:*:*:*:*:*:*:* Versions before cne162d Vulnerable ·IBM
  • cpe:2.3:h:ibm:flex_system_x440_m4:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·IBM
  • cpe:2.3:o:ibm:flex_system_x480_x6_firmware:*:*:*:*:*:*:*:* Versions before n3e132w Vulnerable ·IBM
  • cpe:2.3:h:ibm:flex_system_x480_x6:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·IBM
  • cpe:2.3:o:ibm:flex_system_x880_x6_firmware:*:*:*:*:*:*:*:* Versions before n2e130e Vulnerable ·IBM
  • cpe:2.3:h:ibm:flex_system_x880_x6:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·IBM
  • cpe:2.3:o:ibm:idataplex_dx360_m4_firmware:*:*:*:*:*:*:*:* Versions before fhe120d Vulnerable ·IBM
  • cpe:2.3:h:ibm:idataplex_dx360_m4_:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·IBM
  • cpe:2.3:o:ibm:idataplex_dx360_m4_water_cooled_firmware:*:*:*:*:*:*:*:* Versions before fhe120d Vulnerable ·IBM
  • cpe:2.3:o:ibm:system_x3100_m4_firmware:*:*:*:*:*:*:*:* Versions before jqe184c Vulnerable ·IBM
  • cpe:2.3:h:ibm:system_x3100_m4:*:*:*:*:*:*:*:* Versions all versions Running on ·IBM
  • cpe:2.3:o:ibm:system_x3100_m5_firmware:*:*:*:*:*:*:*:* Versions before j9e134c Vulnerable ·IBM
  • cpe:2.3:h:ibm:system_x3100_m5:*:*:*:*:*:*:*:* Versions all versions Running on ·IBM
  • cpe:2.3:o:ibm:system_x3250_m4_firmware:*:*:*:*:*:*:*:* Versions before jqe184c Vulnerable ·IBM
  • cpe:2.3:h:ibm:system_x3250_m4:*:*:*:*:*:*:*:* Versions all versions Running on ·IBM
  • cpe:2.3:o:ibm:system_x3250_m5_firmware:*:*:*:*:*:*:*:* Versions before jue134c Vulnerable ·IBM
  • cpe:2.3:h:ibm:system_x3250_m5:*:*:*:*:*:*:*:* Versions all versions Running on ·IBM
  • cpe:2.3:o:ibm:system_x3300_m4_firmware:*:*:*:*:*:*:*:* Versions before yae156c Vulnerable ·IBM
  • cpe:2.3:h:ibm:system_x3300_m4:*:*:*:*:*:*:*:* Versions all versions Running on ·IBM
  • cpe:2.3:o:ibm:system_x3500_m4_firmware:*:*:*:*:*:*:*:* Versions before y5e158c Vulnerable ·IBM
  • cpe:2.3:h:ibm:system_x3500_m4:*:*:*:*:*:*:*:* Versions all versions Running on ·IBM
  • cpe:2.3:o:ibm:system_x3530_m4_firmware:*:*:*:*:*:*:*:* Versions before bee164c Vulnerable ·IBM
  • cpe:2.3:h:ibm:system_x3530_m4:*:*:*:*:*:*:*:* Versions all versions Running on ·IBM
  • cpe:2.3:o:ibm:system_x3550_m4_firmware:*:*:*:*:*:*:*:* Versions before d7e166d Vulnerable ·IBM
  • cpe:2.3:h:ibm:system_x3550_m4:*:*:*:*:*:*:*:* Versions all versions Running on ·IBM
  • cpe:2.3:o:ibm:system_x3630_m4_firmware:*:*:*:*:*:*:*:* Versions before vve162c Vulnerable ·IBM
  • cpe:2.3:h:ibm:system_x3630_m4:*:*:*:*:*:*:*:* Versions all versions Running on ·IBM
  • cpe:2.3:o:ibm:system_x3650_m4_firmware:*:*:*:*:*:*:*:* Versions before vve160c Vulnerable ·IBM
  • cpe:2.3:h:ibm:system_x3650_m4:*:*:*:*:*:*:*:* Versions all versions Running on ·IBM
  • cpe:2.3:o:ibm:system_x3650_m4_bd_firmware:*:*:*:*:*:*:*:* Versions before vve160c Vulnerable ·IBM
  • cpe:2.3:h:ibm:system_x3650_m4_bd:*:*:*:*:*:*:*:* Versions all versions Running on ·IBM
  • cpe:2.3:o:ibm:system_x3650_m4_hd_firmware:*:*:*:*:*:*:*:* Versions before vve160c Vulnerable ·IBM
  • cpe:2.3:h:ibm:system_x3650_m4_hd:*:*:*:*:*:*:*:* Versions all versions Running on ·IBM
  • cpe:2.3:o:ibm:system_x3750_m4_firmware:*:*:*:*:*:*:*:* Versions before koe160c Vulnerable ·IBM
  • cpe:2.3:h:ibm:system_x3750_m4:*:*:*:*:*:*:*:* Versions all versions Running on ·IBM
  • cpe:2.3:o:ibm:system_x3850_x6_firmware:*:*:*:*:*:*:*:* Versions before a8e128c Vulnerable ·IBM
  • cpe:2.3:h:ibm:system_x3850_x6:*:*:*:*:*:*:*:* Versions all versions Running on ·IBM
  • cpe:2.3:o:ibm:system_x3950_x6_firmware:*:*:*:*:*:*:*:* Versions before bee164c Vulnerable ·IBM
  • cpe:2.3:h:ibm:system_x3950_x6:*:*:*:*:*:*:*:* Versions all versions Running on ·IBM

Remediation

  • Fix · CNA System x UEFI (Lenovo) Fixed in varies
  • Fix · CNA System x UEFI (IBM) Fixed in varies

Timeline

  1. 2026-10-02 Threatist record created from CVE-2018-9085
  2. 2026-10-03 Alias added: GHSA-r2wg-439c-8pcq
  3. 2026-10-05 EPSS moved to the 50th–90th percentile

References

Advisory 1

  • TI-2019-04360 Sensitive information in log files in Lenovo System x CVSS 3.0HIGH 7.5
  • TI-2018-06584 Hard-coded credentials in Lenovo System x IMM2 CVSS 3.0HIGH 7.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences