CVE-2019-6188 ThinkPad T460p and T470p BIOS Tamper Mechanism

Critical 9.8 Published 12 Nov 2019 Updated 4 Aug 2024

Lenovo ThinkPad BIOS tamper detection fails to trigger, allowing unauthorized physical access to the device.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2019-6188?

CVE-2019-6188 is a critical vulnerability in Lenovo ThinkPad T460p, published on 12 Nov 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The BIOS tamper detection mechanism was not triggered in Lenovo ThinkPad T460p, BIOS versions up to R07ET90W, and T470p, BIOS versions up to R0FET50W, which may allow for unauthorized access.

Which versions are affected by CVE-2019-6188?

It affects 392 products.

Products include Lenovo 130-14ikb Firmware, Lenovo 130-15ikb Firmware, Lenovo 330-14ikb Firmware, Lenovo 330-14ikbr Firmware, Lenovo 330-15ich Firmware, Lenovo 330-15ikb Firmware and 386 more.

How do I fix CVE-2019-6188?

No fix has been published for CVE-2019-6188 yet. Limit exposure of the affected software until one is available.

Is CVE-2019-6188 being exploited?

There is no known exploitation of CVE-2019-6188 in the wild and no public exploit code.

Sources

Also known as GHSA-8v57-95f4-cp8w.