CVE-2018-9062: BIOS Modules Unprotected by Intel Boot Guard Vulnerable to Physical Attack

Severity: medium (CVSS 6.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2018-07-19 · updated 2026-06-17
Weakness: CWE-74

Description

In some Lenovo ThinkPad products, one BIOS region is not properly included in the checks, allowing injection of arbitrary code.

Affected products

Lenovo E42-80 Firmware: before 2wcn40ww — fixed in 2wcn40ww
Lenovo E42-80 Isk Firmware: before 0zcn48ww — fixed in 0zcn48ww
Lenovo E52-80 Firmware: before 2wcn40ww — fixed in 2wcn40ww
Lenovo E52-80 Isk Firmware: before 0zcn48ww — fixed in 0zcn48ww
Lenovo Miix 720-12Ikb Firmware: before 3scn68ww — fixed in 3scn68ww
Lenovo Thinkpad E480 Firmware: before r0pet47w — fixed in r0pet47w
Lenovo Thinkpad E580 Firmware: before r0pet47w — fixed in r0pet47w
Lenovo Thinkpad L380 Firmware: before r0ret28w — fixed in r0ret28w
Lenovo Thinkpad L480 Firmware: before r0qet47w — fixed in r0qet47w
Lenovo Thinkpad L580 Firmware: before r0qet47w — fixed in r0qet47w
Lenovo Thinkpad P51 Firmware: before n1uet71w — fixed in n1uet71w
Lenovo Thinkpad P51S Firmware: before n1vet45w — fixed in n1vet45w
Lenovo Thinkpad P52 Firmware: before n2cet28w — fixed in n2cet28w
Lenovo Thinkpad P52S Firmware: before n27et27w — fixed in n27et27w
Lenovo Thinkpad P71 Firmware: before n1tet50w — fixed in n1tet50w
Lenovo Thinkpad P72 Firmware: before n2cet28w — fixed in n2cet28w
Lenovo Thinkpad S1 Firmware: before r0het48w — fixed in r0het48w
Lenovo Thinkpad T25 Firmware: before n1qet77w — fixed in n1qet77w
Lenovo Thinkpad T470 Firmware: before n1qet77w — fixed in n1qet77w
Lenovo Thinkpad T470P Firmware: before r0fet44w — fixed in r0fet44w
Lenovo Thinkpad T470S Firmware: before n1wet49w — fixed in n1wet49w
Lenovo Thinkpad T480 Firmware: before n24et41w — fixed in n24et41w
Lenovo Thinkpad T480S Firmware: before n22et48w — fixed in n22et48w
Lenovo Thinkpad T570 Firmware: before n1vet45w — fixed in n1vet45w
Lenovo Thinkpad T580 Firmware: before n27et27w — fixed in n27et27w
Lenovo Thinkpad X1 Carbon Firmware: before n1met49w; before n23et52w — fixed in n1met49w, n23et52w
Lenovo Thinkpad X1 Tablet Firmware: before n1oet45w; before n1zet69w — fixed in n1oet45w, n1zet69w
Lenovo Thinkpad X1 Yoga Firmware: before n1net42w; before n25et38w — fixed in n1net42w, n25et38w
Lenovo Thinkpad X270 Firmware: before r0iet53w — fixed in r0iet53w
Lenovo Thinkpad X280 Firmware: before n20et33w — fixed in n20et33w

How to fix

Upgrade to a fixed version: Lenovo E42-80 Firmware 2wcn40ww; Lenovo E42-80 Isk Firmware 0zcn48ww; Lenovo E52-80 Firmware 2wcn40ww; Lenovo E52-80 Isk Firmware 0zcn48ww; Lenovo Miix 720-12Ikb Firmware 3scn68ww; Lenovo Thinkpad E480 Firmware r0pet47w; Lenovo Thinkpad E580 Firmware r0pet47w; Lenovo Thinkpad L380 Firmware r0ret28w; Lenovo Thinkpad L480 Firmware r0qet47w; Lenovo Thinkpad L580 Firmware r0qet47w; Lenovo Thinkpad P51 Firmware n1uet71w; Lenovo Thinkpad P51S Firmware n1vet45w. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2018-9062 or the next vulnerability affects your stack