CVSS 3.0
7.6 highCVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:HCVE-2018-12169
High (7.6). EPSS 0.5% chance of exploitation in the next 30 days.
Platform sample code firmware in 4th Generation Intel Core Processor, 5th Generation Intel Core Processor, 6th Generation Intel Core Processor, 7th Generation Intel Core Processor and 8th Generation Intel Core Processor contains a logic error which may allow physical attacker to potentially bypass firmware authentication.
Severity
- EPSS
- 0.5% chance of exploitation in the next 30 days; higher than 45% of CVEs (scores of 2026-11-01)
- CWE
- CWE-287
- Published
- Modified
- Record from
- the NVD, synced
Affected
- intel:core_i3
- intel:core_i5
- intel:core_i7
- intel:core_i9
- lenovo:thinkpad_11e
- lenovo:thinkpad_e480
- lenovo:thinkpad_e580
- lenovo:thinkpad_l380
- lenovo:thinkpad_l380_yoga
- lenovo:thinkpad_l480
- lenovo:thinkpad_l580
- lenovo:thinkpad_p51
- lenovo:thinkpad_p51s
- lenovo:thinkpad_p52
- lenovo:thinkpad_p52s
- lenovo:thinkpad_p71
- lenovo:thinkpad_p72
- lenovo:thinkpad_t25
- lenovo:thinkpad_t470
- lenovo:thinkpad_t470p
- lenovo:thinkpad_t470s
- lenovo:thinkpad_t480
- lenovo:thinkpad_t480s
- lenovo:thinkpad_t570
- lenovo:thinkpad_t580
- lenovo:thinkpad_x1_carbon
- lenovo:thinkpad_x1_tablet
- lenovo:thinkpad_x1_yoga
- lenovo:thinkpad_x270
- lenovo:thinkpad_x280
- lenovo:thinkpad_x380_yoga
- lenovo:thinkpad_yoga_370
References
- http://www.securityfocus.com/bid/105387
- https://edk2-docs.gitbooks.io/security-advisory/content/unauthenticated-firmware-chain-of-trust-bypass.html
- https://support.lenovo.com/us/en/solutions/LEN-20527
- http://www.securityfocus.com/bid/105387
- https://edk2-docs.gitbooks.io/security-advisory/content/unauthenticated-firmware-chain-of-trust-bypass.html