A potential vulnerability in the SMI callback function used in Legacy USB driver using passed parameter without sufficient checking in some…

published 2019-11-12 6 y ago modified 2026-06-17 4 mo ago also EUVD-2019-15739

cvss: 6.4; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.3%; EPSS 0.3% chance of exploitation in 30 days, percentile 26%
public exploits: 0; none known

A potential vulnerability in the SMI callback function used in Legacy USB driver using passed parameter without sufficient checking in some Lenovo ThinkPad models may allow arbitrary code execution.

Patch / fix

fixed in 10

lenovo thinkpad_helix_firmware gfet65ww
lenovo thinkpad_s531_firmware gket46ww
lenovo thinkpad_t440_firmware gjeta3ww
lenovo thinkpad_t440s_firmware gjeta3ww
lenovo thinkpad_t440p_firmware gleta0ww
lenovo thinkpad_t540p_firmware gmet89ww
lenovo thinkpad_w540_firmware gnet92ww
lenovo thinkpad_w541_firmware gnet92ww
lenovo thinkpad_x240_firmware giet98ww
lenovo thinkpad_x240s_firmware giet98ww

Exploit prediction

0.33% chance of exploitation in the next 30 days, higher than 26% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	6.4	CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
NVD	3.1	6.4	CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
NVD	2.0	4.4	AV:L/AC:M/Au:N/C:P/I:P/A:P

Affected products

Lenovo ThinkPad

References

support.lenovo.com /us/en/product_security/LEN-27714
vendor-advisory

Sources

CVE List CVE-2019-6172
NVD CVE-2019-6172

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary