CVE-2016-8224

MediumCVSS 4.4/10Last modified Jun 17, 2026

Description

A vulnerability has been identified in some Lenovo Notebook and ThinkServer systems where an attacker with administrative privileges on a system could install a program that circumvents Intel Management Engine (ME) protections. This could result in a denial of service or privilege escalation attack on the system.

Metrics

CVSS 3.0 4.4/10CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-310

Affected software

Vendor	Product	Versions
Lenovo Group Ltd.	Lenovo Notebook models 110-14IBR/110-15IBR, B70-80, E31-80, E40-80, E41-80, E51-80, G40-80, G50-80, G50-80 Touch, Ideapad 300-14IBR/300-15IBR, Ideapad 300-14ISK/300-15ISK/300-17ISK, Ideapad 510S-12ISK	various

References

http://www.securityfocus.com/bid/94595
https://support.lenovo.com/us/en/solutions/LEN_9903Vendor Advisory
http://www.securityfocus.com/bid/94595
https://support.lenovo.com/us/en/solutions/LEN_9903Vendor Advisory

Timeline

Published: Nov 29, 2016
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-82257.8Unquoted service path vulnerability in Lenovo Edge and Lenovo Slim USB Keyboard Driver versions earlier than 1.21 allows local users to exec CVE-2016-82264.9The BIOS in Lenovo System X M5, M6, and X6 systems allows administrators to cause a denial of service via updating a UEFI data structure.CVE-2016-82277.8Privilege escalation vulnerability in Lenovo Transition application used in Lenovo Yoga, Flex and Miix systems running Windows allows local CVE-2016-82287.8In Lenovo Service Bridge before version 4, a user with local privileges on a system could execute code with administrative privileges.CVE-2016-82298.8A cross-site request forgery vulnerability in Lenovo Service Bridge before version 4 could be exploited by an attacker with access to the DH CVE-2016-82307.5In Lenovo Service Bridge before version 4, an insecure HTTP connection is used by LSB to send system serial number, machine type and model a CVE-2016-82317.5In Lenovo Service Bridge before version 4, a bug found in the signature verification logic of the code signing certificate could be exploite CVE-2016-82326.1Document Object Model-(DOM) based cross-site scripting vulnerability in the Advanced Management Module (AMM) versions earlier than 66Z of Le CVE-2016-82339.8Log files generated by Lenovo XClarity Administrator (LXCA) versions earlier than 1.2.2 may contain user credentials in a non-secure, clear CVE-2016-82357.8Privilege escalation in Lenovo Customer Care Software Development Kit (CCSDK) versions earlier than 2.0.16.3 allows local users to execute c CVE-2016-82367.5Reset to default settings may occur in Lenovo ThinkServer TSM RD350, RD450, RD550, RD650, TD350 during a prolonged broadcast storm in TSM ve CVE-2016-82378.1Remote code execution in Lenovo Updates (not Lenovo System Update) allows man-in-the-middle attackers to execute arbitrary code.