CVE-2019-6170

MediumCVSS 6.4/10Last modified Jun 17, 2026

Description

A potential vulnerability in the SMI callback function used in the Legacy USB driver using boot services structure in runtime phase in some Lenovo ThinkPad models may allow arbitrary code execution.

Metrics

CVSS 3.1 6.4/10CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

Affected software

No affected versions have been published.

Timeline

Published: Nov 12, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-61716.8A vulnerability was reported in various BIOS versions of older ThinkPad systems that could allow a user with administrative privileges or ph CVE-2019-61726.4A potential vulnerability in the SMI callback function used in Legacy USB driver using passed parameter without sufficient checking in some CVE-2019-61736.5A DLL search path vulnerability could allow privilege escalation in some Lenovo installation packages, prior to version 1.2.9.3, during inst CVE-2019-61757.5A denial of service vulnerability was reported in Lenovo System Update versions prior to 5.07.0088 that could allow configuration files to b CVE-2019-61767.5A potential vulnerability reported in ThinkPad USB-C Dock Firmware version 3.7.2 may allow a denial of service.CVE-2019-61779.8A vulnerability reported in Lenovo Solution Center version 03.12.003, which is no longer supported, could allow log files to be written to n CVE-2019-61785.3An information leakage vulnerability in Iomega and LenovoEMC NAS products could allow disclosure of some device details such as Share names CVE-2019-61797.5An XML External Entity (XXE) processing vulnerability was reported in Lenovo XClarity Administrator (LXCA) prior to version 2.5.0 , Lenovo X CVE-2019-61804.8A stored cross-site scripting (XSS) vulnerability was reported in Lenovo XClarity Administrator (LXCA) versions prior to 2.5.0 that could al CVE-2019-61816.1A reflected cross-site scripting (XSS) vulnerability was reported in Lenovo XClarity Administrator (LXCA) versions prior to 2.5.0 that could CVE-2019-61824.9A stored CSV Injection vulnerability was reported in Lenovo XClarity Administrator (LXCA) versions prior to 2.5.0 that could allow an admini CVE-2019-61837.5A denial of service vulnerability has been reported in Lenovo Energy Management Driver for Windows 10 versions prior to 15.11.29.7 that coul