CVE-2019-6171

Severity: medium (CVSS 6.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2019-08-19 · updated 2026-06-17

Description

A vulnerability was reported in various BIOS versions of older ThinkPad systems that could allow a user with administrative privileges or physical access the ability to update the Embedded Controller with unsigned firmware.

Affected products

Lenovo 20A7 Firmware: all versions
Lenovo 20A8 Firmware: all versions
Lenovo 20A9 Firmware: all versions
Lenovo 20Aa Firmware: all versions
Lenovo 20Ab Firmware: all versions
Lenovo 20Ac Firmware: all versions
Lenovo 20Aj Firmware: all versions
Lenovo 20Ak Firmware: all versions
Lenovo 20Al Firmware: all versions
Lenovo 20Am Firmware: all versions
Lenovo 20An Firmware: all versions
Lenovo 20Aq Firmware: all versions
Lenovo 20Ar Firmware: all versions
Lenovo 20Aw Firmware: all versions
Lenovo 20B0 Firmware: all versions
Lenovo 20B3 Firmware: all versions
Lenovo 20B6 Firmware: all versions
Lenovo 20B7 Firmware: all versions
Lenovo 20Be Firmware: all versions
Lenovo 20Bf Firmware: all versions
Lenovo 20Bg Firmware: all versions
Lenovo 20Bl Firmware: all versions
Lenovo 20Bm Firmware: all versions
Lenovo 20Bu Firmware: all versions
Lenovo 20Bv Firmware: all versions
Lenovo 20Bw Firmware: all versions
Lenovo 20Bx Firmware: all versions
Lenovo 20D9 Firmware: all versions
Lenovo 20Da Firmware: all versions
Lenovo 20Dc Firmware: all versions

References

Get alerted when CVE-2019-6171 or the next vulnerability affects your stack