CVE-2019-6172

MediumCVSS 6.4/10Last modified Jun 17, 2026

Description

A potential vulnerability in the SMI callback function used in Legacy USB driver using passed parameter without sufficient checking in some Lenovo ThinkPad models may allow arbitrary code execution.

Metrics

CVSS 3.1 6.4/10CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

Affected software

VendorProductVersions
LenovoThinkPad>= Various, < Various

References

Timeline

Published
Nov 12, 2019
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2019

CVE-2019-61736.5A DLL search path vulnerability could allow privilege escalation in some Lenovo installation packages, prior to version 1.2.9.3, during instCVE-2019-61757.5A denial of service vulnerability was reported in Lenovo System Update versions prior to 5.07.0088 that could allow configuration files to bCVE-2019-61767.5A potential vulnerability reported in ThinkPad USB-C Dock Firmware version 3.7.2 may allow a denial of service.CVE-2019-61779.8A vulnerability reported in Lenovo Solution Center version 03.12.003, which is no longer supported, could allow log files to be written to nCVE-2019-61785.3An information leakage vulnerability in Iomega and LenovoEMC NAS products could allow disclosure of some device details such as Share names CVE-2019-61797.5An XML External Entity (XXE) processing vulnerability was reported in Lenovo XClarity Administrator (LXCA) prior to version 2.5.0 , Lenovo XCVE-2019-61804.8A stored cross-site scripting (XSS) vulnerability was reported in Lenovo XClarity Administrator (LXCA) versions prior to 2.5.0 that could alCVE-2019-61816.1A reflected cross-site scripting (XSS) vulnerability was reported in Lenovo XClarity Administrator (LXCA) versions prior to 2.5.0 that couldCVE-2019-61824.9A stored CSV Injection vulnerability was reported in Lenovo XClarity Administrator (LXCA) versions prior to 2.5.0 that could allow an adminiCVE-2019-61837.5A denial of service vulnerability has been reported in Lenovo Energy Management Driver for Windows 10 versions prior to 15.11.29.7 that coulCVE-2019-61847.8A potential vulnerability in the discontinued Customer Engagement Service (CCSDK) software version 2.0.21.1 may allow local privilege escalaCVE-2019-61868.8A potential vulnerability was reported in Lenovo System Interface Foundation versions before v1.1.18.3 that could allow an authenticated use
CVE-2019-6172: Medium severity, CVSS 6.4 | Vulnix