Skip to content
Fencer Vulns
low 3.3

CVE-2019-6156 json

In Lenovo systems, SMM BIOS Write Protection is used to prevent writes to SPI Flash.

published 2019-04-10 7 y ago modified 2026-06-17 4 mo ago also EUVD-2019-15723

cvss
3.3
version 3.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
0.2%
EPSS 0.2% chance of exploitation in 30 days, percentile 15%
public exploits
0
none known

Summary

In Lenovo systems, SMM BIOS Write Protection is used to prevent writes to SPI Flash. While this provides sufficient protection, an additional layer of protection is provided by SPI Protected Range Registers (PRx). Lenovo was notified that after resuming from S3 sleep mode in various versions of BIOS for Lenovo systems, the PRx is not set. This does not impact the SMM BIOS Write Protection, which keeps systems protected.

Patch / fix

  • lenovo ideacentre_510-15icb_firmware o3qkt32a
  • lenovo ideacentre_510a-15icb_firmware o3qkt32a
  • lenovo ideacentre_700_firmware fwkt9aa
  • lenovo ideacentre_720-18icb_firmware o3qkt32a
  • lenovo legion_c530-19icb_firmware o3lkt20a
  • lenovo legion_c730-19ico_firmware o3nkt20a
  • lenovo legion_t530-28icb_firmware o3lkt20a
  • lenovo legion_t730-28ico_firmware o3nkt20a
  • lenovo thinkcentre_e93_(sff)_firmware fbktd5a
  • lenovo thinkcentre_e93_(twr)_firmware fbktd5a
  • lenovo thinkcentre_m610_firmware m1akt3fa
  • lenovo thinkcentre_m6500t_firmware fbktd5a
  • lenovo thinkcentre_m6500s_firmware fbktd5a
  • lenovo thinkcentre_m6600_firmware fwkt9aa
  • lenovo thinkcentre_m6600q_firmware fwkt9aa
  • lenovo thinkcentre_m6600t_firmware fwkt9aa
  • lenovo thinkcentre_m6600s_firmware fwkt9aa
  • lenovo thinkcentre_m700q_firmware fwkt9aa
  • lenovo thinkcentre_m710q_firmware m1akt3fa
  • lenovo thinkcentre_m720q_firmware m1ukt33a

Exploit prediction

0.24% chance of exploitation in the next 30 days, higher than 15% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
NVD 3.0 3.3 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
NVD 2.0 2.1 AV:L/AC:L/Au:N/C:N/I:P/A:N

Affected products

  • Lenovo BIOS

Classification

Weakness

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.