What’s Vulnerable › Vulnerabilities

CVE-2018-12169

• Severity: high (CVSS 7.6 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2018-09-21 · updated 2026-06-17
• Weakness: CWE-287

Description

Platform sample code firmware in 4th Generation Intel Core Processor, 5th Generation Intel Core Processor, 6th Generation Intel Core Processor, 7th Generation Intel Core Processor and 8th Generation Intel Core Processor contains a logic error which may allow physical attacker to potentially bypass firmware authentication.

Affected products

• Intel Core I3: 4000m, 4005u, 4010u, 4010y, 4012y, 4020y (+74)
• Intel Core I5: 7y54, 7y57, 4200h, 4200m, 4200u, 4200y (+117)
• Intel Core I7: 7y75, 4500u, 4510u, 4550u, 4558u, 4578u (+107)
• Intel Core I9: 8950hk
• Lenovo Thinkpad 11E: all versions
• Lenovo Thinkpad E480: all versions
• Lenovo Thinkpad E580: all versions
• Lenovo Thinkpad L380: all versions
• Lenovo Thinkpad L380 Yoga: all versions
• Lenovo Thinkpad L480: all versions
• Lenovo Thinkpad L580: all versions
• Lenovo Thinkpad P51: all versions
• Lenovo Thinkpad P51S: all versions
• Lenovo Thinkpad P52: all versions
• Lenovo Thinkpad P52S: all versions
• Lenovo Thinkpad P71: all versions
• Lenovo Thinkpad P72: all versions
• Lenovo Thinkpad T25: all versions
• Lenovo Thinkpad T470: all versions
• Lenovo ThinkPad T470p: all versions
• Lenovo Thinkpad T470S: all versions
• Lenovo Thinkpad T480: all versions
• Lenovo Thinkpad T480S: all versions
• Lenovo Thinkpad T570: all versions
• Lenovo Thinkpad T580: all versions
• Lenovo Thinkpad X1 Carbon: all versions
• Lenovo Thinkpad X1 Tablet: all versions
• Lenovo Thinkpad X1 Yoga: all versions
• Lenovo Thinkpad X270: all versions
• Lenovo Thinkpad X280: all versions

References

• http://www.securityfocus.com/bid/105387
• https://edk2-docs.gitbooks.io/security-advisory/content/unauthenticated-firmware-chain-of-trust-bypass.html
• https://support.lenovo.com/us/en/solutions/LEN-20527
• http://www.securityfocus.com/bid/105387
• https://edk2-docs.gitbooks.io/security-advisory/content/unauthenticated-firmware-chain-of-trust-bypass.html
• https://support.lenovo.com/us/en/solutions/LEN-20527

Get alerted when CVE-2018-12169 or the next vulnerability affects your stack