How severe is CVE-2019-6156?

CVE-2019-6156 has a CVSS 3.x base score of 3.3, rated low severity. It is exploitable over local access with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is none, integrity low, and availability none.

Is CVE-2019-6156 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (15th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2019-6156?

CVE-2019-6156 primarily affects Lenovo 510-15ikl Firmware. In total, 177 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2019-6156?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2019-6156 published?

CVE-2019-6156 was published on 2019-04-10 and last updated on 2026-06-17.

CVE-2019-6156

CVE-2019-6156 is a low-severity vulnerability in Lenovo 510-15ikl Firmware with a CVSS 3.x base score of 3.3. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-667.

Key facts

Severity: Low (CVSS 3.x base score 3.3)
CVSS v2: 2.1
EPSS exploit prediction: 0% (15th percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-667
Affected product: Lenovo 510-15ikl Firmware
Published: 2019-04-10
Last modified: 2026-06-17

Description

In Lenovo systems, SMM BIOS Write Protection is used to prevent writes to SPI Flash. While this provides sufficient protection, an additional layer of protection is provided by SPI Protected Range Registers (PRx). Lenovo was notified that after resuming from S3 sleep mode in various versions of BIOS for Lenovo systems, the PRx is not set. This does not impact the SMM BIOS Write Protection, which keeps systems protected.

Frequently asked questions

What is CVE-2019-6156?: In Lenovo systems, SMM BIOS Write Protection is used to prevent writes to SPI Flash. While this provides sufficient protection, an additional layer of protection is provided by SPI Protected Range Registers (PRx). Lenovo was notified that after resuming from S3 sleep mode in various versions of BIOS for Lenovo systems, the PRx is not set. This does not impact the SMM BIOS Write Protection, which keeps systems protected.
How severe is CVE-2019-6156?: CVE-2019-6156 has a CVSS 3.x base score of 3.3, rated low severity. It is exploitable over local access with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is none, integrity low, and availability none.
Is CVE-2019-6156 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (15th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2019-6156?: CVE-2019-6156 primarily affects Lenovo 510-15ikl Firmware. In total, 177 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2019-6156?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2019-6156 published?: CVE-2019-6156 was published on 2019-04-10 and last updated on 2026-06-17.

References

https://support.lenovo.com/solutions/LEN-26332

Affected products (177)

cpe:2.3:o:lenovo:510-15ikl_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:lenovo:510s-08ikl_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:lenovo:ideacentre_300-20ish_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:lenovo:ideacentre_300s-11ish_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:lenovo:ideacentre_510-15icb_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:lenovo:ideacentre_510a-15icb_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:lenovo:ideacentre_510s-08ish_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:lenovo:ideacentre_620s-03ikl_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:lenovo:ideacentre_700_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:lenovo:ideacentre_720-18icb_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:lenovo:legion_c530-19icb_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:lenovo:legion_c730-19ico_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:lenovo:legion_t530-28icb_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:lenovo:legion_t730-28ico_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:lenovo:legion_y520t_z370_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:lenovo:legion_y720_tower_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:lenovo:legion_y920_tower_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:lenovo:lenovo_63_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:lenovo:h50-30g_desktop_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:lenovo:m4500_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:lenovo:m4500_id_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:lenovo:m4550_id_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:lenovo:530s-07icb_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:lenovo:qitian_4500_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:lenovo:qitian_b4550_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:lenovo:qitian_b4650_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:lenovo:qitian_m4550_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:lenovo:qitian_m4600_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:lenovo:qitian_m4650_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:lenovo:qt_m410_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:lenovo:qt_b415_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:lenovo:qt_m415_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:lenovo:thinkcentre_e73_\(sff\)_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:lenovo:thinkcentre_e73_\(twr\)_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:lenovo:thinkcentre_e73s_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:lenovo:thinkcentre_e74_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:lenovo:thinkcentre_e74s_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:lenovo:thinkcentre_e75t_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:lenovo:thinkcentre_e75s_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:lenovo:thinkcentre_e93_\(sff\)_firmware:*:*:*:*:*:*:*:*

More vulnerabilities in Lenovo 510-15ikl Firmware

CVE-2019-6188 — Critical (CVSS 9.8): The BIOS tamper detection mechanism was not triggered in Lenovo ThinkPad T460p, BIOS versions up to R07ET90W, and…
CVE-2019-6172 — Medium (CVSS 6.4): A potential vulnerability in the SMI callback function used in Legacy USB driver using passed parameter without…
CVE-2019-6170 — Medium (CVSS 6.4): A potential vulnerability in the SMI callback function used in the Legacy USB driver using boot services structure in…
CVE-2019-6190 — Medium (CVSS 5.0): Lenovo was notified of a potential denial of service vulnerability, affecting various versions of BIOS for Lenovo…

All CVEs affecting Lenovo 510-15ikl Firmware →

Other CWE-667 (Improper Locking) vulnerabilities

CVE-2020-12658 — Critical (CVSS 9.8): gssproxy (aka gss-proxy) before 0.8.3 does not unlock cond_mutex before pthread exit in gp_worker_main() in…
CVE-2019-5886 — Critical (CVSS 9.8): An issue was discovered in ShopXO 1.2.0. In the application\install\controller\Index.php file, there is no validation…
CVE-2026-43215 — High (CVSS 8.8): In the Linux kernel, the following vulnerability has been resolved: cifs: Fix locking usage for tcon fields We used…
CVE-2026-31629 — High (CVSS 8.8): In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: add missing return after LLCP_CLOSED…
CVE-2020-15674 — High (CVSS 8.8): Mozilla developers reported memory safety bugs present in Firefox 80. Some of these bugs showed evidence of memory…
CVE-2021-1622 — High (CVSS 8.6): A vulnerability in the Common Open Policy Service (COPS) of Cisco IOS XE Software for Cisco cBR-8 Converged Broadband…

Browse all CWE-667 (Improper Locking) vulnerabilities →