CVE-2019-6171

CVE-2019-6171 affects older ThinkPad models where an attacker with administrative privileges or physical access can cause the Embedded Controller to accept unsigned firmware updates. Root cause is unsigned firmware update capability in the EC, enabling privilege escalation via BIOS/EC update path...