Untrusted search path in Lenovo Bootable Generator
Priority LOW 36CWE-426Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-426.
Summary
A DLL search path vulnerability was reported in Lenovo Bootable Generator, prior to version Mar-2019, that could allow a malicious user with local access to execute code on the system.
Why it matters now
EPSS 0.00918 60th percentileScored 2026-11-07
Fix Fixed Lenovo Bootable Generator (Lenovo): Mar-2019
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Lenovo | Lenovo Bootable Generator | before Mar-2019 | Mar-2019 | Patch available | CNA |
- Lenovo Bootable Generator VendorLenovo Affected before Mar-2019 Fixed in Mar-2019 Patch available CNA
CPE configurations NVD · 5
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:lenovo:bootable_usb:*:*:*:*:*:windows:*:* | before mar-2019 | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:ideacentre:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:h:lenovo:thinkcentre:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:h:lenovo:thinkpad:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:h:lenovo:thinkstation:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
- cpe:2.3:a:lenovo:bootable_usb:*:*:*:*:*:windows:*:* Versions before mar-2019 Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:ideacentre:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:h:lenovo:thinkcentre:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:h:lenovo:thinkpad:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:h:lenovo:thinkstation:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
Remediation
- Fix · CNA Lenovo Bootable Generator (Lenovo) Fixed in Mar-2019
Timeline
- 2026-10-02 Threatist record created from CVE-2019-6154
- 2026-10-03 Alias added: GHSA-frhj-2f22-m53q
References
Sources
- CVE-2019-6154 · CVE Program
- CVE-2019-6154 · NVD
- FIRST EPSS
- GHSA-frhj-2f22-m53q · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences