Skip to content
Fencer Vulns
medium 4.9

CVE-2018-9085 json

Missing System x Flash Memory Write Protection Lock Bit

published 2018-11-16 7 y ago modified 2026-06-17 4 mo ago also EUVD-2018-20688

cvss
4.9
version 3.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
0.7%
EPSS 0.7% chance of exploitation in 30 days, percentile 52%
public exploits
0
none known

Summary

A write protection lock bit was left unset after boot on an older generation of Lenovo and IBM System x servers, potentially allowing an attacker with administrator access to modify the subset of flash memory containing Intel Server Platform Services (SPS) and the system Flash Descriptors.

Patch / fix

  • lenovo flex_system_x240_m4_firmware a3e122b
  • lenovo flex_system_x440_m4_firmware cge122b
  • lenovo system_x3750_m4_firmware a5e124b
  • ibm bladecenter_hs23_firmware tke160c
  • ibm bladecenter_hs23e_firmware ahe160c
  • ibm flex_system_x220_m4_firmware kse158c
  • ibm flex_system_x222_m4_firmware cce160c
  • ibm flex_system_x240_m4_firmware ahe160c
  • ibm flex_system_x280_x6_firmware n3e132w
  • ibm flex_system_x440_m4_firmware cne162d
  • ibm flex_system_x480_x6_firmware n3e132w
  • ibm flex_system_x880_x6_firmware n2e130e
  • ibm idataplex_dx360_m4_firmware fhe120d
  • ibm idataplex_dx360_m4_water_cooled_firmware fhe120d
  • ibm system_x3100_m4_firmware jqe184c
  • ibm system_x3100_m5_firmware j9e134c
  • ibm system_x3250_m4_firmware jqe184c
  • ibm system_x3250_m5_firmware jue134c
  • ibm system_x3300_m4_firmware yae156c
  • ibm system_x3500_m4_firmware y5e158c

Exploit prediction

0.66% chance of exploitation in the next 30 days, higher than 52% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
NVD 3.0 4.9 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
NVD 2.0 4.0 AV:N/AC:L/Au:S/C:N/I:P/A:N

Affected products

  • Lenovo System x UEFI
  • IBM System x UEFI

Classification

Weakness
  • CWE-276 Incorrect Default Permissions

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.