Code injection

2018-05-0417:29:00

PRIOn knowledge base

www.prio-n.com

6.2 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

30.4%

JSON

Some Lenovo System x server BIOS/UEFI versions, when Secure Boot mode is enabled by a system administrator, do not properly authenticate signed code before booting it. As a result, an attacker with physical access to the system could boot unsigned code.

CPENameOperatorVersion
flex_system_x240_m5_bioslt2.61
flex_system_x280_x6_bioslt4.21
flex_system_x480_x6_bioslt4.21
flex_system_x880_bioslt4.21
nextscale_nx360_m5_bioslt2.61
system_x3250_m6_bioslt2.23
system_x3500_m5_bioslt2.61
system_x3550_m5_bioslt2.61
system_x3650_m5_bioslt2.61
system_x3850_x6_bioslt4.3

Name	Operator	Version
flex_system_x240_m5_bios	lt	2.61
flex_system_x280_x6_bios	lt	4.21
flex_system_x480_x6_bios	lt	4.21
flex_system_x880_bios	lt	4.21
nextscale_nx360_m5_bios	lt	2.61
system_x3250_m6_bios	lt	2.23
system_x3500_m5_bios	lt	2.61
system_x3550_m5_bios	lt	2.61
system_x3650_m5_bios	lt	2.61
system_x3850_x6_bios	lt	4.3