What’s Vulnerable › Vulnerabilities

CVE-2019-6190

• Severity: medium (CVSS 5.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2020-02-14 · updated 2026-06-17
• Weakness: CWE-665

Description

Lenovo was notified of a potential denial of service vulnerability, affecting various versions of BIOS for Lenovo Desktop, Desktop - All in One, and ThinkStation, that could cause PCRs to be cleared intermittently after resuming from sleep (S3) on systems with Intel TXT enabled.

Affected products

• Lenovo 510-15Ikl Firmware: before o2tkt61a — fixed in o2tkt61a
• Lenovo 510S-08Ikl Firmware: before o2tkt61a — fixed in o2tkt61a
• Lenovo A340-22 Iwl Firmware: before o46kt31a — fixed in o46kt31a
• Lenovo A340-22Ast Firmware: before o4ckt18a — fixed in o4ckt18a
• Lenovo A340-22Icb Firmware: before o44kt26a — fixed in o44kt26a
• Lenovo A340-24 Iwl Firmware: before o46kt31a — fixed in o46kt31a
• Lenovo A340-24Icb Firmware: before o44kt26a — fixed in o44kt26a
• Lenovo Aio520-22Iku Firmware: before o3dkt38a — fixed in o3dkt38a
• Lenovo Aio520-24Arr Firmware: before o3zkt36a — fixed in o3zkt36a
• Lenovo Aio520-24Iku Firmware: before o3dkt38a — fixed in o3dkt38a
• Lenovo Aio520-27Ikl Firmware: before o3ekt27a — fixed in o3ekt27a
• Lenovo Aio 330-20Ast Firmware: before o3rkt23a — fixed in o3rkt23a
• Lenovo Aio 330-20Igm Firmware: before o3skt46a — fixed in o3skt46a
• Lenovo Aio 520-24Ast Firmware: before o3bkt34a — fixed in o3bkt34a
• Lenovo H50-30G Desktop Firmware: before fckt97a — fixed in fckt97a
• Lenovo Ideacentre 310S-08Asr Firmware: before o2hkt63a — fixed in o2hkt63a
• Lenovo Ideacentre 310S-08Igm Firmware: before m1tkt24a — fixed in m1tkt24a
• Lenovo Ideacentre 510-15Icb Firmware: before o3qkt3ba — fixed in o3qkt3ba
• Lenovo Ideacentre 510A-15Icb Firmware: before o3qkt3ba — fixed in o3qkt3ba
• Lenovo Ideacentre 700 Firmware: before fwkta7a — fixed in fwkta7a
• Lenovo Ideacentre 720-18Apr Firmware: before m25kt40a — fixed in m25kt40a
• Lenovo Ideacentre 720-18Icb Firmware: before o3qkt3ba — fixed in o3qkt3ba
• Lenovo Ideacentre 730S-24Ikb Firmware: before o3wkt18a — fixed in o3wkt18a
• Lenovo Legion C530-19Icb Firmware: before o3lkt23a — fixed in o3lkt23a
• Lenovo Legion C730-19Ico Firmware: before o3nkt26a — fixed in o3nkt26a
• Lenovo Legion T530-28Apr Firmware: before o4gkt0fa — fixed in o4gkt0fa
• Lenovo Legion T530-28Apr Reflash Firmware: before o4gkt0fa — fixed in o4gkt0fa
• Lenovo Legion T530-28Icb Firmware: before o3lkt23a — fixed in o3lkt23a
• Lenovo Legion T530-28Icb Reflash Firmware: before o3lkt23a — fixed in o3lkt23a
• Lenovo Legion T730-28Ico Firmware: before o3nkt26a — fixed in o3nkt26a

How to fix

Upgrade to a fixed version: Lenovo 510-15Ikl Firmware o2tkt61a; Lenovo 510S-08Ikl Firmware o2tkt61a; Lenovo A340-22 Iwl Firmware o46kt31a; Lenovo A340-22Ast Firmware o4ckt18a; Lenovo A340-22Icb Firmware o44kt26a; Lenovo A340-24 Iwl Firmware o46kt31a; Lenovo A340-24Icb Firmware o44kt26a; Lenovo Aio520-22Iku Firmware o3dkt38a; Lenovo Aio520-24Arr Firmware o3zkt36a; Lenovo Aio520-24Iku Firmware o3dkt38a; Lenovo Aio520-27Ikl Firmware o3ekt27a; Lenovo Aio 330-20Ast Firmware o3rkt23a. Check the vendor advisory for mitigations.

References

• https://support.lenovo.com/us/en/product_security/LEN-28078
• https://exchange.xforce.ibmcloud.com/vulnerabilities/176178
• https://support.lenovo.com/us/en/product_security/LEN-28078

Get alerted when CVE-2019-6190 or the next vulnerability affects your stack