What’s Vulnerable › Vulnerabilities

CVE-2018-9069: BIOS Write Protection Race Condition

• Severity: medium (CVSS 5.9 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2018-10-02 · updated 2026-06-17
• Weakness: CWE-362

Description

In some Lenovo IdeaPad consumer notebook models, a race condition in the BIOS flash device locking mechanism is not adequately protected against, potentially allowing an attacker with administrator access to alter the contents of BIOS.

Affected products

• HP 310S-14Isk Firmware: before 1.15 — fixed in 1.15
• HP 320-15Ikbra Firmware: before 6jcn24ww — fixed in 6jcn24ww
• HP 320-15Ikbrn Firmware: before 6jcn24ww — fixed in 6jcn24ww
• HP 320-15Ikbrn Touch Firmware: before 6jcn24ww — fixed in 6jcn24ww
• HP 320-17Ikbrn: before 2.09 — fixed in 2.09
• HP 320S-14Ikb: before 2.09 — fixed in 2.09
• HP 320S-15Ikb Firmware: before 2.09 — fixed in 2.09
• HP 320S-15Isk Firmware: before 2wcn38ww — fixed in 2wcn38ww
• HP 510S-14Isk Firmware: before 1.15 — fixed in 1.15
• HP 520-15Ikbrn Firmware: before 6jcn26ww — fixed in 6jcn26ww
• HP 520S-14Ikb Firmware: before 2.09 — fixed in 2.09
• HP 7000-15 U42 Firmware: before 2.09 — fixed in 2.09
• HP 7000 U42 Firmware: before 2.09 — fixed in 2.09
• HP 710S Plus-13Ikb 16G Firmware: before 2.55 — fixed in 2.55
• HP 710S Plus-3Ikb Firmware: before 2.55 — fixed in 2.55
• HP 710S Plus Touch-13Ikb Firmware: before 2.55 — fixed in 2.55
• HP 720S-13Ikb Firmware: before 5scn38ww — fixed in 5scn38ww
• HP B320-14Ikb Firmware: all versions
• HP E43-80 Kbl Firmware: before 4.07 — fixed in 4.07
• HP Flex 4-1470 Firmware: before 1.15 — fixed in 1.15
• HP Flex 5-1470 Firmware: before 2.09 — fixed in 2.09
• HP Flex 5-1570 Firmware: before 2.09 — fixed in 2.09
• HP Ideapad 2In1 14 Firmware: all versions
• HP Lenovo Ideapad 320-14Ikb(I+A) Firmware: all versions
• HP Lenovo Ideapad 320-14Ikb(I+N) Firmware: all versions
• HP Lenovo Ideapad 320-15Abr Firmware: all versions
• HP Lenovo Ideapad 320-15Ikb(I+N) Firmware: all versions
• HP Lenovo Ideapad 320S-14Ikbr Firmware: all versions
• HP Lenovo Ideapad 320S-15Ikbr Firmware: all versions
• HP Lenovo Ideapad 520S-14Ikbr Firmware: all versions

How to fix

Upgrade to a fixed version: HP 310S-14Isk Firmware 1.15; HP 320-15Ikbra Firmware 6jcn24ww; HP 320-15Ikbrn Firmware 6jcn24ww; HP 320-15Ikbrn Touch Firmware 6jcn24ww; HP 320-17Ikbrn 2.09; HP 320S-14Ikb 2.09; HP 320S-15Ikb Firmware 2.09; HP 320S-15Isk Firmware 2wcn38ww; HP 510S-14Isk Firmware 1.15; HP 520-15Ikbrn Firmware 6jcn26ww; HP 520S-14Ikb Firmware 2.09; HP 7000-15 U42 Firmware 2.09. Check the vendor advisory for mitigations.

References

• https://support.lenovo.com/us/en/solutions/LEN-20184
• https://support.lenovo.com/us/en/solutions/LEN-20184

Get alerted when CVE-2018-9069 or the next vulnerability affects your stack