Embedded Controller Update Vulnerability
Embedded Controller Update Vulnerability
Embedded Controller Update Vulnerability
Lenovo Security Advisory: LEN-27764
Potential Impact: Privilege escalation
Severity: Medium
Scope of Impact: Lenovo-specific
CVE Identifier: CVE-2019-6171
Summary Description:
A vulnerability was reported in older ThinkPad systems that could allow a user with administrative privileges or physical access the ability to update the Embedded Controller with unsigned firmware.
Mitigation Strategy for Customers (what you should do to protect yourself):
Update to the version of BIOS (or later) described for your system in the product impact section.
Product Impact:
Product | Model | Minimum Fix Version | Download Link | Last Updated |
ThinkPad 10 | 20E3, 20E4 | N1AETC5W | https://pcsupport.lenovo.com/downloads/DS104930 | 2019-11-22 |
ThinkPad 11e/Yoga 11e 3RD GEN | 20G9, 20GB, 20G8, 20GA | R0BET41W | https://pcsupport.lenovo.com/downloads/ds112170 | 2020-02-21 |
ThinkPad 11e/Yoga 11e 3RD GEN | 20G9, 20GB, 20G8, 20GA | R0AET39W | https://pcsupport.lenovo.com/downloads/DS112168 | 2020-02-21 |
ThinkPad 11e/Yoga 11e 4TH GEN | 20HT, 20HV, 20HS, 20HU | R0LET34W | https://pcsupport.lenovo.com/downloads/DS120787 | 2020-02-21 |
ThinkPad 11e/Yoga 11e 4TH GEN | 20HT, 20HV, 20HS, 20HU | R0LET34W | https://pcsupport.lenovo.com/downloads/DS120787 | 2020-02-21 |
ThinkPad 11e/Yoga 11e 5TH GEN (GML) | 20LR, 20LQ, 20LN, 20LM | R0TET61W | https://pcsupport.lenovo.com/downloads/DS502469 | 2020-02-21 |
ThinkPad 11e/Yoga 11e 5TH GEN (KBY-Y) | 20LR, 20LQ, 20LN, 20LM | R0VET36W | https://pcsupport.lenovo.com/downloads/DS500803 | 2020-02-21 |
ThinkPad 13 (KBL) | 20J1, 20J2 | R0JET40W | https://pcsupport.lenovo.com/downloads/DS119785 | 2020-02-21 |
ThinkPad 13 (KBL) | 20J1, 20J2 | R0CET45W | https://pcsupport.lenovo.com/downloads/DS112474 | 2020-02-21 |
ThinkPad A275 | 20KC, 20KD | R0NET42W | https://pcsupport.lenovo.com/downloads/DS500803 | 2020-02-21 |
ThinkPad A285 | 20MW, 20MX | R0XET64W | https://pcsupport.lenovo.com/downloads/DS504873 | 2020-02-21 |
ThinkPad A475 | 20KL, 20KM | R04ET41W | https://pcsupport.lenovo.com/downloads/DS500949 | 2020-02-21 |
ThinkPad A485 | 20MU, 20MV | R0WET60W | https://pcsupport.lenovo.com/downloads/DS504078 | 2020-02-21 |
ThinkPad E450/E450c/E550/E550c | 20DC, 20DD, 30EH, 20DF, 20DG, 20E0 | J5ET64WW | https://pcsupport.lenovo.com/downloads/ds101972 | 2020-02-21 |
ThinkPad E460/E560 | 20ET, 20EU, 20EV, 20EW | R00ET64W | https://pcsupport.lenovo.com/downloads/DS105367 | 2020-02-21 |
ThinkPad E465/E565 | 20EX, 20EY | R01ET43W | https://pcsupport.lenovo.com/downloads/DS105375 | 2020-02-21 |
ThinkPad E470/E570 | 20H1, 20H2, 20H5, 20H6 | R0DETA0W | https://pcsupport.lenovo.com/downloads/DS119160 | 2020-02-21 |
ThinkPad E475/E575 | 20H4, 20H8 | R0EET49W | https://pcsupport.lenovo.com/downloads/DS119276 | 2020-02-21 |
ThinkPad E480/E580 | 20KN, 20KQ, 20KS, 20KT | R0PET63W | https://pcsupport.lenovo.com/downloads/DS501843 | 2020-02-21 |
ThinkPad E485/E585 | 20KU, 20KV | R0UET76W | https://pcsupport.lenovo.com/downloads/DS503790 | 2020-02-21 |
ThinkPad E490s /ThinkPad S3/ ThinkPad E490/E590/R490/R590 | 20N8, 20N9, 20NG | R0YET37W | https://pcsupport.lenovo.com/downloads/DS506071 | 2020-02-21 |
ThinkPad E570 / ThinkPad S5 | 20H5, 20H6 | R0DETA0W | https://pcsupport.lenovo.com/downloads/DS119160 | 2020-02-21 |
ThinkPad Helix | 20CG, 20CH | Not affected | 2019-08-08 | |
ThinkPad Helix | 3XXX | GFET65WW | https://pcsupport.lenovo.com/downloads/DS034627 | 2019-10-09 |
ThinkPad L380 / S3 3rd Gen ThinkPad L380 Yoga / S2 Yoga 3rd Gen |
20M5, 20M6, 20M7, 20M8 | R0RET40W | https://pcsupport.lenovo.com/downloads/DS502400 | 2020-02-21 |
ThinkPad L390 Yoga /ThinkPad S2 Yoga 4th Gen | 20NR, 20NS, 20NT, 20NU | R10ET43W | https://pcsupport.lenovo.com/downloads/DS505882 | 2020-02-21 |
ThinkPad L450 | 20DS, 20DT | JDET69WW | https://pcsupport.lenovo.com/downloads/DS102108 | 2020-02-21 |
ThinkPad L460 | 20FU, 20FV | R08ET65W | https://pcsupport.lenovo.com/downloads/DS112197 | 2020-02-21 |
ThinkPad L470 | 20J4, 20J5 | R0GET71W | https://pcsupport.lenovo.com/downloads/DS120327 | 2020-02-21 |
ThinkPad L470 | 20JU, 20JV | R0GET71W | https://pcsupport.lenovo.com/downloads/DS120327 | 2020-02-21 |
ThinkPad L480/L580 | 20LS, 20LT, 20L2, 20LX | R0PET63W | https://pcsupport.lenovo.com/downloads/DS502441 | 2020-02-21 |
ThinkPad L560 | 20F1, 20F2 | N1HET87W | https://pcsupport.lenovo.com/downloads/DS112214 | 2019-11-22 |
ThinkPad L570 | 20JQ, 20JR | N1XET67W | https://pcsupport.lenovo.com/downloads/DS120885 | 2019-11-22 |
ThinkPad P1 | 20MD, 20ME | Not affected | 2019-08-08 | |
ThinkPad P50 | 20EN, 20EQ | Not affected | 2019-08-08 | |
ThinkPad P50s | 20FK, 20FL | Not affected | 2019-08-08 | |
ThinkPad P51 | 20HH, 20HJ | Not affected | 2019-08-08 | |
ThinkPad P51 | 20MM, 20MN | Not affected | 2019-08-08 | |
ThinkPad P51s | 20HB, 20HC | Not affected | 2019-08-08 | |
ThinkPad P51s | 20JY, 20K0 | Not affected | 2019-08-08 | |
ThinkPad P52 | 20M9, 20MA | Not affected | 2019-08-08 | |
ThinkPad P52s | 20LB, 20LC | Not affected | 2019-08-08 | |
ThinkPad P70 | 20ER, 20ES | Not affected | 2019-08-08 | |
ThinkPad P71 | 20HK, 20HL | Not affected | 2019-08-08 | |
ThinkPad P72 | 20MB, 20MC | Not affected | 2019-08-08 | |
ThinkPad S1 Yoga (Non-vPro) | GQET62WW | https://pcsupport.lenovo.com/downloads/DS038334 | 2019-11-22 | |
ThinkPad S1 Yoga (vPro) | B0ET46WW | https://pcsupport.lenovo.com/downloads/DS038334 | 2019-11-22 | |
ThinkPad S5 2nd Generation | 20JA | R0MET49W | https://pcsupport.lenovo.com/downloads/ds120836 | 2020-02-21 |
ThinkPad S5 Yoga 15 | 20DQ, 20DR | N19ET62W | https://pcsupport.lenovo.com/downloads/DS102341 | 2019-11-22 |
ThinkPad S5/E560p | 20G5,20G4 | R09ET73W | https://pcsupport.lenovo.com/downloads/DS113037 | 2020-02-21 |
ThinkPad S531 | 20B0 | GKET46WW | https://pcsupport.lenovo.com/downloads/DS035584 | 2020-03-13 |
ThinkPad S540 | 20B3 | GPET80WW | https://pcsupport.lenovo.com/downloads/DS038373 | 2019-11-22 |
ThinkPad T25 | 20K7 | Not affected | 2019-08-08 | |
ThinkPad T430, T430i | 234x, 235x | G1ETC2WW | https://pcsupport.lenovo.com/downloads/DS029252 | 2019-08-27 |
ThinkPad T430s | 235x | G7ETB6WW | https://pcsupport.lenovo.com/downloads/DS029724 | 2019-11-22 |
ThinkPad T431s | 20A9, 20AA, 20AB, 20AC | GHET44WW | https://pcsupport.lenovo.com/downloads/DS034505 | 2019-10-06 |
ThinkPad T440/T440s | 20B6, 20B7, 20AQ, 20AR | GJETA3WW | https://pcsupport.lenovo.com/downloads/DS035965 | 2019-09-25 |
ThinkPad T440p | 20AN, 20AW | GLETA0WW | https://pcsupport.lenovo.com/downloads/DS037575 | 2019-10-06 |
ThinkPad T450/T450s | 20BU, 20BV, 20DJ, 20BW, 20BX | Not affected | 2020-02-21 | |
ThinkPad T460 | 20FM, 20FN | Not affected | 2020-02-21 | |
ThinkPad T460p | 20FW, 20FX | Not affected | 2020-02-21 | |
ThinkPad T460s | 20F9, 20FA | Not affected | 2019-08-08 | |
ThinkPad T470 | 20HD, 20HE | Not affected | 2019-08-08 | |
ThinkPad T470 | 20JM, 20JN | Not affected | 2019-08-08 | |
ThinkPad T470p | 20J6, 20J7 | Not affected | 2020-02-21 | |
ThinkPad T470s | 20HF, 20HG | Not affected | 2019-08-08 | |
ThinkPad T470s | 20JS, 20JT | Not affected | 2019-08-08 | |
ThinkPad T480 | 20L5, 20L6 | Not affected | 2019-08-08 | |
ThinkPad T480s | 20L7, 20L8 | Not affected | 2019-08-08 | |
ThinkPad T490 | 20N2, 20N3 | Not affected | 2019-08-08 | |
ThinkPad T490s | 20NX, 20NY | Not affected | 2019-08-08 | |
ThinkPad T530, T530i | 235x, 239x, 242x, 243x | G4ETB7WW | https://pcsupport.lenovo.com/downloads/DS029246 | 2019-10-06 |
ThinkPad T540/T540p | 20BE, 20BF | GMET89WW | https://pcsupport.lenovo.com/downloads/DS038147 | 2019-10-06 |
ThinkPad T550 | 20CJ, 20CK | Not affected | 2019-08-08 | |
ThinkPad T560 | 20FH, 20FJ | Not affected | 2019-08-08 | |
ThinkPad T570 | 20JW, 20JX | Not affected | 2019-08-08 | |
ThinkPad T570 | 20H9, 20HA | Not affected | 2019-08-08 | |
ThinkPad T580 | 20L9, 20LA | Not affected | 2019-08-08 | |
ThinkPad T590 | 20N4, 20N5 | Not affected | 2019-08-08 | |
ThinkPad Tablet 10 (32-bit) | 20C1, 20C3 | GUET86WW | https://pcsupport.lenovo.com/downloads/DS041534 | 2019-11-22 |
ThinkPad Tablet 10 (64-bit) | 20C1, 20C3 | GWET49WW | https://pcsupport.lenovo.com/downloads/DS041804 | 2019-11-22 |
ThinkPad Tablet 8 (32-bit) | 20BN, 20BQ | GTET79WW | https://pcsupport.lenovo.com/us/en/products/TABLETS/THINKPAD-TABLET-SERIES/THINKPAD-8/downloads/DS100744 | 2020-04-03 |
ThinkPad Tablet 8 (64-bit) | 20BN, 20BQ | GYET41WW | https://pcsupport.lenovo.com/us/en/products/TABLETS/THINKPAD-TABLET-SERIES/THINKPAD-8/downloads/DS100744 | 2020-04-03 |
ThinkPad W530 | 243x, 244x, 246x | G5ETB6WW | https://pcsupport.lenovo.com/downloads/DS029169 | 2019-10-06 |
ThinkPad W540/W541 | 20BG, 20BG, 20EF, 20EG | GNET92WW | https://pcsupport.lenovo.com/downloads/DS039077 | 2019-10-06 |
ThinkPad W550s | 20E1, 20E2 | Not affected | 2019-08-08 | |
ThinkPad X1 Carbon | 34xx | G6ETC5WW | https://pcsupport.lenovo.com/downloads/DS030684 | 2019-09-25 |
ThinkPad X1 Carbon 3nd Gen | 20A7, 20A8 | GRET62WW | https://pcsupport.lenovo.com/downloads/DS039782 | 2019-09-25 |
ThinkPad X1 Carbon 3rd Gen | 20BS, 20BT | Not affected | 2019-08-08 | |
ThinkPad X1 Carbon 5th Gen (KBL) | 20HR, 20HQ | Not affected | 2019-08-08 | |
ThinkPad X1 Carbon 5th Gen (SKL) | 20K3, 20K4 | Not affected | 2019-08-08 | |
ThinkPad X1 Carbon 6th Gen | 20KH, 20KG | Not affected | 2019-08-08 | |
ThinkPad X1 Carbon, X1 Yoga 4th Gen | 20FB, 20FC, 20FQ, 20FR | Not affected | 2019-08-08 | |
ThinkPad X1 Extreme | 20MF, 20MG | Not affected | 2019-08-08 | |
ThinkPad X1 Tablet | 20GG, 20GH | Not affected | 2019-08-08 | |
ThinkPad X1 Tablet | 20JB, 20JC | Not affected | 2019-08-08 | |
ThinkPad X1 Tablet | 20KJ, 20KK | Not affected | 2019-08-08 | |
ThinkPad X1 Yoga | 20JD, 20JE, 20JF, 20JG | Not affected | 2019-08-08 | |
ThinkPad X1 Yoga | 20LD, 20LE, 20LF, 20LG | Not affected | 2019-08-08 | |
ThinkPad X131e (Intel) | 336x, 337x | G8ETB4WW | https://pcsupport.lenovo.com/downloads/DS029771 | 2019-11-22 |
ThinkPad X140e (AMD) | 20BL, 20BM | GSET73WW | https://pcsupport.lenovo.com/downloads/DS038561 | 2019-11-22 |
ThinkPad X230 Tablet; X230i Tablet | 343x, 344x | GCETB5WW | https://pcsupport.lenovo.com/downloads/DS029683 | 2019-10-09 |
ThinkPad X230, X230i | 230x, 232x, 233x | G2ETB7WW | https://pcsupport.lenovo.com/downloads/DS029187 | 2019-10-09 |
ThinkPad X240 | 20AL, 20AM | GIET98WW | https://pcsupport.lenovo.com/downloads/DS035950 | 2019-08-27 |
ThinkPad X240s | 20AJ, 20AK | GIET98WW | https://pcsupport.lenovo.com/downloads/DS035950 | 2019-08-27 |
ThinkPad X250 | 20CL, 20CM | Not affected | 2019-08-08 | |
ThinkPad X260 | 20F5, 20F6 | R02ET72W | https://pcsupport.lenovo.com/downloads/DS105890 | 2020-02-21 |
ThinkPad X270 | 20HN, 20HM | R0IET59W | https://pcsupport.lenovo.com/downloads/DS120442 | 2020-02-21 |
ThinkPad X270 | 20K5, 20K6 | R0IET59W | https://pcsupport.lenovo.com/downloads/DS120442 | 2020-02-21 |
ThinkPad X280 | 20KE, 20KF | Not affected | 2019-08-08 | |
ThinkPad X380 Yoga | 20LH, 20LJ | R0SET47W | https://pcsupport.lenovo.com/downloads/DS502333 | 2020-02-21 |
ThinkPad X390 | 20Q0, 20Q1 | Not affected | 2019-08-08 | |
ThinkPad X390 Yoga | 20NN, 20NQ | N2LET65W | https://pcsupport.lenovo.com/downloads/DS539544 | 2019-08-29 |
ThinkPad Yoga 11e | 20D9, 20DA | N15ET78W | https://pcsupport.lenovo.com/downloads/DS041529 | 2019-11-22 |
ThinkPad Yoga 260, S1 | 20FD, 20FE, 20GS, 20GT | Not affected | 2019-08-08 | |
ThinkPad Yoga 370 /ThinkPad S1 3rd | 20JH, 20JJ | Not affected | 2019-09-25 |
Acknowledgement:
Lenovo would like to thank Alex Matrosov and Alexandre Gazet for reporting this issue.
Revision History:
Revision | Date | Description |
---|---|---|
16 | 2020-06-18 | Updated Title since this is not unique to ThinkPad |
15 | 2020-04-03 | Updated ThinkPad |
14 | 2020-03-13 | Updated IdeaPad and ThinkPad |
13 | 2020-02-21 | Updated ThinkPad |
12 | 2020-01-23 | Updated IdeaPad |
11 | 2019-12-12 | Added IdeaPad; updated fix targets for ThinkPad |
10 | 2019-11-22 | Added fixes |
9 | 2019-11-11 | Updated fix targets |
8 | 2019-10-09 | Updated fix targets |
7 | 2019-10-06 | Updated fix targets and added fixes |
6 | 2019-09-25 | Updated fix targets and added fix |
5 | 2019-08-29 | Updated fix targets and added fix |
4 | 2019-08-27 | Added fixes |
3 | 2019-08-13 | Updated fix target for some products |
2 | 2019-08-09 | Updated Product Impact |
1 | 2019-08-08 | Initial release |
For a complete list of all Lenovo Product Security Advisories, click here.
For the most up to date information, please remain current with updates and advisories from Lenovo regarding your equipment and software. The information provided in this advisory is provided on an “as is” basis without any warranty or guarantee of any kind. Lenovo reserves the right to change or update this advisory at any time.
Your feedback helps to improve the overall experience