CVE-2018-9085: Missing System x Flash Memory Write Protection Lock Bit

Severity: medium (CVSS 4.9 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2018-11-16 · updated 2026-06-17
Weakness: CWE-276

Description

A write protection lock bit was left unset after boot on an older generation of Lenovo and IBM System x servers, potentially allowing an attacker with administrator access to modify the subset of flash memory containing Intel Server Platform Services (SPS) and the system Flash Descriptors.

Affected products

IBM Bladecenter Hs23 Firmware: before tke160c — fixed in tke160c
IBM Bladecenter Hs23E Firmware: before ahe160c — fixed in ahe160c
IBM Flex System X220 M4 Firmware: before kse158c — fixed in kse158c
IBM Flex System X222 M4 Firmware: before cce160c — fixed in cce160c
IBM Flex System X240 M4 Firmware: before ahe160c — fixed in ahe160c
IBM Flex System X280 X6 Firmware: before n3e132w — fixed in n3e132w
IBM Flex System X440 M4 Firmware: before cne162d — fixed in cne162d
IBM Flex System X480 X6 Firmware: before n3e132w — fixed in n3e132w
IBM Flex System X880 X6 Firmware: before n2e130e — fixed in n2e130e
IBM Idataplex Dx360 M4 Firmware: before fhe120d — fixed in fhe120d
IBM Idataplex Dx360 M4 Water Cooled Firmware: before fhe120d — fixed in fhe120d
IBM System X3100 M4 Firmware: before jqe184c — fixed in jqe184c
IBM System X3100 M5 Firmware: before j9e134c — fixed in j9e134c
IBM System X3250 M4 Firmware: before jqe184c — fixed in jqe184c
IBM System X3250 M5 Firmware: before jue134c — fixed in jue134c
IBM System X3300 M4 Firmware: before yae156c — fixed in yae156c
IBM System X3500 M4 Firmware: before y5e158c — fixed in y5e158c
IBM System X3530 M4 Firmware: before bee164c — fixed in bee164c
IBM System X3550 M4 Firmware: before d7e166d — fixed in d7e166d
IBM System X3630 M4 Firmware: before vve162c — fixed in vve162c
IBM System X3650 M4 Bd Firmware: before vve160c — fixed in vve160c
IBM System X3650 M4 Firmware: before vve160c — fixed in vve160c
IBM System X3650 M4 Hd Firmware: before vve160c — fixed in vve160c
IBM System X3750 M4 Firmware: before koe160c — fixed in koe160c
IBM System X3850 X6 Firmware: before a8e128c — fixed in a8e128c
IBM System X3950 X6 Firmware: before bee164c — fixed in bee164c
Lenovo Flex System X240 M4 Firmware: before a3e122b — fixed in a3e122b
Lenovo Flex System X440 M4 Firmware: before cge122b — fixed in cge122b
Lenovo System X3750 M4 Firmware: before a5e124b — fixed in a5e124b

How to fix

Upgrade to a fixed version: IBM Bladecenter Hs23 Firmware tke160c; IBM Bladecenter Hs23E Firmware ahe160c; IBM Flex System X220 M4 Firmware kse158c; IBM Flex System X222 M4 Firmware cce160c; IBM Flex System X240 M4 Firmware ahe160c; IBM Flex System X280 X6 Firmware n3e132w; IBM Flex System X440 M4 Firmware cne162d; IBM Flex System X480 X6 Firmware n3e132w; IBM Flex System X880 X6 Firmware n2e130e; IBM Idataplex Dx360 M4 Firmware fhe120d; IBM Idataplex Dx360 M4 Water Cooled Firmware fhe120d; IBM System X3100 M4 Firmware jqe184c. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2018-9085 or the next vulnerability affects your stack