What’s Vulnerable › Vulnerabilities

CVE-2015-5684

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 3.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2020-03-27 · updated 2026-06-17
• Weakness: CWE-120

Description

MITRE is populating this ID because it was assigned prior to Lenovo becoming a CNA. A buffer overflow vulnerability was reported, (fixed and publicly disclosed in 2015) in the Lenovo Service Engine (LSE), affecting various versions of BIOS for Lenovo Notebooks, that could allow a remote user to execute arbitrary code on the system.

Affected products

• Lenovo B50-10 Firmware: before cccn13ww\(v1.02\) — fixed in cccn13ww\(v1.02\)
• Lenovo Edge 15 Firmware: before a9cn46ww; before b9cn17ww — fixed in a9cn46ww, b9cn17ww
• Lenovo Flex 2 Pro-15 Firmware: before a9cn46ww; before b9cn17ww — fixed in a9cn46ww, b9cn17ww
• Lenovo Flex 3-1120 Firmware: before c0cn25ww — fixed in c0cn25ww
• Lenovo Flex 3-1470 Firmware: before bdcn30ww — fixed in bdcn30ww
• Lenovo Flex 3-1570 Firmware: before bdcn30ww — fixed in bdcn30ww
• Lenovo G40-80 Firmware: before b0cn75ww — fixed in b0cn75ww
• Lenovo G40-80M Firmware: before cbcn75ww — fixed in cbcn75ww
• Lenovo G50-80 Firmware: before b0cn75ww — fixed in b0cn75ww
• Lenovo G50-80 Touch Firmware: before b0cn75ww — fixed in b0cn75ww
• Lenovo G50-80 Touch V3000 Firmware: before b0cn75ww — fixed in b0cn75ww
• Lenovo G50-80M Firmware: before cbcn75ww — fixed in cbcn75ww
• Lenovo G70-80 Firmware: before abcn75ww — fixed in abcn75ww
• Lenovo Ideapad 100-14Iby Firmware: before v1.02_\(cccn13ww\) — fixed in v1.02_\(cccn13ww\)
• Lenovo Ideapad 100-15Iby Firmware: before v1.02_\(cccn13ww\) — fixed in v1.02_\(cccn13ww\)
• Lenovo M40-35 Firmware: before bbcn15ww\(v1.06\) — fixed in bbcn15ww\(v1.06\)
• Lenovo S21E Firmware: before c4cn14ww\(v1.04\) — fixed in c4cn14ww\(v1.04\)
• Lenovo S41-70 Firmware: before bdcn30ww — fixed in bdcn30ww
• Lenovo S435 Firmware: before bbcn15ww\(v1.06\) — fixed in bbcn15ww\(v1.06\)
• Lenovo U31-70 Firmware: before afcn30ww\(v2.02\) — fixed in afcn30ww\(v2.02\)
• Lenovo U41-70 Firmware: before bdcn30ww — fixed in bdcn30ww
• Lenovo Y40-80 Firmware: before b5cn36ww\(v2.02\) — fixed in b5cn36ww\(v2.02\)
• Lenovo Yoga 3 11 Firmware: before b8cn30ww\(v2.08\) — fixed in b8cn30ww\(v2.08\)
• Lenovo Yoga 3 14 Firmware: before bacn33ww — fixed in bacn33ww
• Lenovo Z41-70 Firmware: before c2cn18ww\(v1.04\) — fixed in c2cn18ww\(v1.04\)
• Lenovo Z51-70 Firmware: before c2cn18ww\(v1.04\) — fixed in c2cn18ww\(v1.04\)
• Lenovo Z70-80 Firmware: before abcn75ww — fixed in abcn75ww

How to fix

Upgrade to a fixed version: Lenovo B50-10 Firmware cccn13ww\(v1.02\); Lenovo Edge 15 Firmware a9cn46ww, b9cn17ww; Lenovo Flex 2 Pro-15 Firmware a9cn46ww, b9cn17ww; Lenovo Flex 3-1120 Firmware c0cn25ww; Lenovo Flex 3-1470 Firmware bdcn30ww; Lenovo Flex 3-1570 Firmware bdcn30ww; Lenovo G40-80 Firmware b0cn75ww; Lenovo G40-80M Firmware cbcn75ww; Lenovo G50-80 Firmware b0cn75ww; Lenovo G50-80 Touch Firmware b0cn75ww; Lenovo G50-80 Touch V3000 Firmware b0cn75ww; Lenovo G50-80M Firmware cbcn75ww. Check the vendor advisory for mitigations.

References

• https://support.lenovo.com/us/en/product_security/lse_bios_notebook
• https://support.lenovo.com/us/en/product_security/lse_bios_notebook

Get alerted when CVE-2015-5684 or the next vulnerability affects your stack