CVE-2018-9069

MediumCVSS 5.9/10Last modified Jun 17, 2026

Description

In some Lenovo IdeaPad consumer notebook models, a race condition in the BIOS flash device locking mechanism is not adequately protected against, potentially allowing an attacker with administrator access to alter the contents of BIOS.

Metrics

CVSS 3.1 5.9/10CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:H

Weakness enumeration

CWE-362

Affected software

No affected versions have been published.

Timeline

Published
Oct 2, 2018
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2018

CVE-2018-90706.4For the Lenovo Smart Assistant Android app versions earlier than 12.1.82, an attacker with physical access to the smart speaker can, by presCVE-2018-90715.3Lenovo Chassis Management Module (CMM) prior to version 2.0.0 allows unauthenticated users to retrieve information related to the current auCVE-2018-90726.5In versions prior to 5.5, LXCI for VMware allows an authenticated user to download any system file due to insufficient input sanitization duCVE-2018-90735.9Lenovo Chassis Management Module (CMM) prior to version 2.0.0 utilizes a hardcoded encryption key to protect certain secrets. Possession of CVE-2018-90746.5For some Iomega, Lenovo, LenovoEMC NAS devices versions 4.1.402.34662 and earlier, the file upload functionality of the Content Explorer appCVE-2018-90758.1For some Iomega, Lenovo, LenovoEMC NAS devices versions 4.1.402.34662 and earlier, when joining a PersonalCloud setup, an attacker can craftCVE-2018-90768.1For some Iomega, Lenovo, LenovoEMC NAS devices versions 4.1.402.34662 and earlier, when changing the name of a share, an attacker can craft CVE-2018-90778.1For some Iomega, Lenovo, LenovoEMC NAS devices versions 4.1.402.34662 and earlier, when changing the name of a share, an attacker can craft CVE-2018-90788.8For some Iomega, Lenovo, LenovoEMC NAS devices versions 4.1.402.34662 and earlier, the Content Explorer application grants users the abilityCVE-2018-90799.8For some Iomega, Lenovo, LenovoEMC NAS devices versions 4.1.402.34662 and earlier, adversaries can craft URLs to modify the Document Object CVE-2018-90805.9For some Iomega, Lenovo, LenovoEMC NAS devices versions 4.1.402.34662 and earlier, by setting the Iomega cookie to a known value before loggCVE-2018-90814.7For some Iomega, Lenovo, LenovoEMC NAS devices versions 4.1.402.34662 and earlier, the file name used for assets accessible through the Cont
CVE-2018-9069: Medium severity, CVSS 5.9 | Vulnix