What’s Vulnerable › Vulnerabilities

CVE-2019-6170

• Severity: medium (CVSS 6.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2019-11-12 · updated 2026-06-17

Description

A potential vulnerability in the SMI callback function used in the Legacy USB driver using boot services structure in runtime phase in some Lenovo ThinkPad models may allow arbitrary code execution.

Affected products

• Lenovo 130-14Ikb Firmware: all versions
• Lenovo 130-15Ikb Firmware: all versions
• Lenovo 330-14Ikb Firmware: all versions
• Lenovo 330-14Ikbr Firmware: all versions
• Lenovo 330-15Ich Firmware: all versions
• Lenovo 330-15Ikb Firmware: all versions
• Lenovo 330-15Ikbr Firmware: all versions
• Lenovo 330-15Ikbr Touch Firmware: all versions
• Lenovo 330-17Ich Firmware: all versions
• Lenovo 330-17Ikb Firmware: all versions
• Lenovo 330-17Ikbr Firmware: all versions
• Lenovo 330C-14Ikb Firmware: all versions
• Lenovo 330C-15Ikb Firmware: all versions
• Lenovo 330C-15Ikbr Firmware: all versions
• Lenovo 340C-15Ikb Firmware: all versions
• Lenovo 340C-15Iwl Firmware: all versions
• Lenovo 510-15Ikl Firmware: all versions
• Lenovo 510S-08Ikl Firmware: all versions
• Lenovo 530S-14Ikb Firmware: all versions
• Lenovo 530S-14Iwl Firmware: all versions
• Lenovo 530S-15Ikb Firmware: all versions
• Lenovo 530S-15Iwl Firmware: all versions
• Lenovo 63 Firmware: all versions
• Lenovo 720S-14Ikbr Firmware: all versions
• Lenovo 720S-15Ikb Firmware: all versions
• Lenovo 720S Touch-15Ikb Firmware: all versions
• Lenovo 730S-13Iwl Firmware: all versions
• Lenovo A340-22 Iwl Firmware: all versions
• Lenovo A340-22Ast Firmware: all versions
• Lenovo A340-22Icb Firmware: all versions

References

• https://support.lenovo.com/us/en/product_security/LEN-27714
• https://support.lenovo.com/us/en/product_security/LEN-27714

Get alerted when CVE-2019-6170 or the next vulnerability affects your stack