CVE-2019-6155

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

A potential vulnerability was found in an SMI handler in various BIOS versions of certain legacy IBM System x and IBM BladeCenter systems that could lead to denial of service.

Metrics

CVSS 3.0 7.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected software

Vendor	Product	Versions
IBM	System x BIOS	various
IBM	BladeCenter BIOS	various

References

https://support.lenovo.com/solutions/LEN-25165Third Party Advisory
https://support.lenovo.com/solutions/LEN-25165Third Party Advisory

Timeline

Published: Apr 22, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-61563.3In Lenovo systems, SMM BIOS Write Protection is used to prevent writes to SPI Flash. While this provides sufficient protection, an additiona CVE-2019-61577.5In various firmware versions of Lenovo System x, the integrated management module II (IMM2)'s first failure data capture (FFDC) includes the CVE-2019-61585.9An internal product security audit of Lenovo XClarity Administrator (LXCA) discovered HTTP proxy credentials being written to a log file in CVE-2019-61596.1A stored cross-site scripting (XSS) vulnerability exists in various firmware versions of the legacy IBM System x IMM (IMM v1) embedded Baseb CVE-2019-61607.5A vulnerability in various versions of Iomega and LenovoEMC NAS products could allow an unauthenticated user to access files on NAS shares v CVE-2019-61617.5An internal product security audit discovered a session handling vulnerability in the web interface of ThinkAgile CP-SB (Storage Block) BMC CVE-2019-61637.5A denial of service vulnerability was reported in Lenovo System Update before version 5.07.0084 that could allow service log files to be wri CVE-2019-61657.8A DLL search path vulnerability was reported in PaperDisplay Hotkey Service version 1.2.0.8 that could allow privilege escalation. Lenovo ha CVE-2019-61668.8A vulnerability reported in Lenovo Service Bridge before version 4.1.0.1 could allow cross-site request forgery.CVE-2019-61679.8A vulnerability reported in Lenovo Service Bridge before version 4.1.0.1 could allow remote code execution.CVE-2019-61689.8A vulnerability reported in Lenovo Service Bridge before version 4.1.0.1 could allow remote code execution.CVE-2019-61697.5A vulnerability reported in Lenovo Service Bridge before version 4.1.0.1 could allow unencrypted downloads over FTP.