high
7.2
CWE
74
Advisory Published
Updated

CVE-2018-9062: BIOS Modules Unprotected by Intel Boot Guard Vulnerable to Physical Attack

First published: Thu Jul 19 2018(Updated: )

In some Lenovo ThinkPad products, one BIOS region is not properly included in the checks, allowing injection of arbitrary code.

Credit: psirt@lenovo.com

Affected SoftwareAffected VersionHow to fix
Lenovo e42-80<2wcn40ww
Lenovo e42-80 firmware
Lenovo e42-80 firmware<0zcn48ww
Lenovo e42-80
Lenovo e52-80 isk firmware<2wcn40ww
Lenovo e52-80
Lenovo e52-80<0zcn48ww
Lenovo e52-80 isk firmware
Lenovo Miix 720-12IKB<3scn68ww
Lenovo Miix 720-12IKB Firmware
Lenovo v310-14ikb firmware<2wcn40ww
Lenovo v310-14ikb firmware
Lenovo v310-14isk firmware<0zcn48ww
Lenovo v310-14ikb
Lenovo v310-15ikb<2wcn40ww
Lenovo v310-15ikb firmware
Lenovo v310-15isk<0zcn48ww
Lenovo v310-15isk firmware
Lenovo V510-14IKB Firmware<2wcn40ww
Lenovo V510-14IKB Firmware
Lenovo v510-15ikb firmware<2wcn40ww
HP v510-15ikb
Lenovo ThinkPad L380 Firmware<r0ret28w
Lenovo ThinkPad L380
Lenovo ThinkPad e480 firmware<r0pet47w
Lenovo ThinkPad E480
Lenovo ThinkPad e580 firmware<r0pet47w
Lenovo Thinkpad E580
Lenovo ThinkPad L480 Firmware<r0qet47w
Lenovo ThinkPad L480
Lenovo ThinkPad L580 Firmware<r0qet47w
Lenovo ThinkPad L580 Firmware
Lenovo ThinkPad P51 Firmware<n1uet71w
Lenovo ThinkPad P51
Lenovo ThinkPad P51s (20HX) Firmware<n1vet45w
Lenovo ThinkPad P51s Firmware
Lenovo ThinkPad P52 Firmware<n2cet28w
Lenovo ThinkPad P52
Lenovo ThinkPad P52s Firmware<n27et27w
Lenovo ThinkPad P52s Firmware
Lenovo ThinkPad P71 Firmware<n1tet50w
Lenovo ThinkPad P71 Firmware
Lenovo ThinkPad P72 Firmware<n2cet28w
Lenovo ThinkPad P72 Firmware
Lenovo ThinkPad T25 Firmware<n1qet77w
Lenovo ThinkPad T25 Firmware
Lenovo ThinkPad T470 firmware<n1qet77w
Lenovo ThinkPad T470p
Lenovo ThinkPad T470p firmware<r0fet44w
Lenovo ThinkPad T470p
Lenovo ThinkPad T470s Firmware<n1wet49w
Lenovo ThinkPad T470s Firmware
Lenovo ThinkPad T480 Firmware<n24et41w
Lenovo ThinkPad T480
Lenovo ThinkPad T480s Firmware<n22et48w
Lenovo ThinkPad T480s Firmware
Lenovo ThinkPad T570 Firmware<n1vet45w
Lenovo ThinkPad T570 Firmware
Lenovo ThinkPad T580 Firmware<n27et27w
Lenovo ThinkPad T580
Lenovo ThinkPad x380 Yoga Firmware<r0set29w
Lenovo ThinkPad X380 Yoga
Lenovo ThinkPad Yoga 11e Firmware<r0vet23w
Lenovo ThinkPad 11e YOGA
Lenovo ThinkPad Yoga 370 Firmware<r0het48w
Lenovo ThinkPad Yoga 370 Firmware
Lenovo ThinkPad S1 Firmware<r0het48w
Lenovo ThinkPad S1 Firmware
Lenovo ThinkPad X1 Carbon Firmware<n1met49w
Lenovo ThinkPad 20HQ
Lenovo 20hr
Lenovo ThinkPad X1 Carbon Firmware<n23et52w
Lenovo 20k3
Lenovo 20k4
Lenovo 20kg
Lenovo 20kh
Lenovo ThinkPad X1 Tablet Firmware<n1oet45w
Lenovo 20jb
Lenovo 20jc
Lenovo ThinkPad X1 Tablet Firmware<n1zet69w
Lenovo 20kj
Lenovo 20kk
Lenovo ThinkPad X1 Yoga (20SX) Firmware<n1net42w
Lenovo 20jd
Lenovo 20je
Lenovo 20jf
Lenovo 20jg
Lenovo ThinkPad X1 Yoga (20SX) Firmware<n25et38w
Lenovo 20ld
Lenovo 20le
Lenovo 20lf
Lenovo 20lg
Lenovo ThinkPad x270 firmware<r0iet53w
Lenovo 20hm
Lenovo 20hn
Lenovo 20k5 Firmware
Lenovo 20k6 Firmware
Lenovo ThinkPad x280 firmware<n20et33w
Lenovo 20ke
Lenovo 20KF

Remedy

https://support.lenovo.com/us/en/solutions/LEN-20527

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

Reference Links

Frequently Asked Questions

  • What is the severity of CVE-2018-9062?

    CVE-2018-9062 is rated as a high severity vulnerability due to its potential for arbitrary code execution.

  • How do I fix CVE-2018-9062?

    To mitigate CVE-2018-9062, users should update their Lenovo ThinkPad products to the latest firmware that addresses this vulnerability.

  • Which devices are affected by CVE-2018-9062?

    CVE-2018-9062 affects a variety of Lenovo ThinkPad and Miix models, especially those running outdated firmware versions.

  • What type of vulnerability is CVE-2018-9062?

    CVE-2018-9062 is an arbitrary code execution vulnerability in the BIOS of certain Lenovo devices.

  • Can CVE-2018-9062 be exploited remotely?

    Yes, CVE-2018-9062 can potentially be exploited remotely if an attacker has access to the vulnerable BIOS environment.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2025 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203