How severe is CVE-2019-6190?

CVE-2019-6190 has a CVSS 3.x base score of 5.0, rated medium severity. It is exploitable over local access with low attack complexity, requires low privileges and user interaction. Impact on confidentiality is none, integrity none, and availability high.

Is CVE-2019-6190 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (20th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2019-6190?

CVE-2019-6190 primarily affects Lenovo Thinkcentre E93 Firmware. In total, 182 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2019-6190?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2019-6190 published?

CVE-2019-6190 was published on 2020-02-14 and last updated on 2026-06-17.

CVE-2019-6190

CVE-2019-6190 is a medium-severity vulnerability in Lenovo Thinkcentre E93 Firmware with a CVSS 3.x base score of 5.0. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-665.

Key facts

Severity: Medium (CVSS 3.x base score 5.0)
CVSS v2: 2.1
EPSS exploit prediction: 0% (20th percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-665
Affected product: Lenovo Thinkcentre E93 Firmware
Published: 2020-02-14
Last modified: 2026-06-17

Description

Lenovo was notified of a potential denial of service vulnerability, affecting various versions of BIOS for Lenovo Desktop, Desktop - All in One, and ThinkStation, that could cause PCRs to be cleared intermittently after resuming from sleep (S3) on systems with Intel TXT enabled.

Frequently asked questions

What is CVE-2019-6190?: Lenovo was notified of a potential denial of service vulnerability, affecting various versions of BIOS for Lenovo Desktop, Desktop - All in One, and ThinkStation, that could cause PCRs to be cleared intermittently after resuming from sleep (S3) on systems with Intel TXT enabled.
How severe is CVE-2019-6190?: CVE-2019-6190 has a CVSS 3.x base score of 5.0, rated medium severity. It is exploitable over local access with low attack complexity, requires low privileges and user interaction. Impact on confidentiality is none, integrity none, and availability high.
Is CVE-2019-6190 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (20th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2019-6190?: CVE-2019-6190 primarily affects Lenovo Thinkcentre E93 Firmware. In total, 182 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2019-6190?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2019-6190 published?: CVE-2019-6190 was published on 2020-02-14 and last updated on 2026-06-17.

References

Affected products (182)

cpe:2.3:o:lenovo:thinkcentre_e93_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:lenovo:thinkcentre_m6500s_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:lenovo:thinkcentre_m6500t_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:lenovo:thinkcentre_m73p_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:lenovo:thinkcentre_m83_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:lenovo:thinkcentre_m8500s_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:lenovo:thinkcentre_m8500t_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:lenovo:thinkcentre_m93_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:lenovo:thinkcentre_m93p_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:lenovo:thinkstation_e32_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:lenovo:thinkstation_p300_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:lenovo:thinkstation_c30_refresh_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:lenovo:thinkstation_d30_refresh_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:lenovo:thinkstation_p410_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:lenovo:thinkstation_p500_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:lenovo:thinkstation_p510_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:lenovo:thinkstation_p700_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:lenovo:thinkstation_p710_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:lenovo:thinkstation_p720_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:lenovo:thinkstation_p900_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:lenovo:thinkstation_p910_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:lenovo:thinkstation_p920_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:lenovo:thinkstation_s30_refresh_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:lenovo:h50-30g_desktop_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:lenovo:lenovo_63_desktop_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:lenovo:m4500_desktop_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:lenovo:m4500_id_desktop_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:lenovo:m4550_id_desktop_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:lenovo:qitian_4500_desktop_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:lenovo:qitian_b4550_desktop_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:lenovo:qitian_m4550_desktop_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:lenovo:thinkcentre_e73_desktop_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:lenovo:thinkcentre_e73s_desktop_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:lenovo:thinkcentre_m4500k_desktop_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:lenovo:thinkcentre_m4500s_desktop_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:lenovo:thinkcentre_m4500t_desktop_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:lenovo:thinkcentre_m73_desktop_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:lenovo:yangtian_afh81_desktop_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:lenovo:yangtian_mc_h81_desktop_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:lenovo:yangtian_mf_h81_pci_desktop_firmware:*:*:*:*:*:*:*:*

More vulnerabilities in Lenovo Thinkcentre E93 Firmware

CVE-2019-6188 — Critical (CVSS 9.8): The BIOS tamper detection mechanism was not triggered in Lenovo ThinkPad T460p, BIOS versions up to R07ET90W, and…
CVE-2017-3753 — Medium (CVSS 6.8): A vulnerability has been identified in some Lenovo products that use UEFI (BIOS) code developed by American Megatrends,…
CVE-2021-3719 — Medium (CVSS 6.7): A potential vulnerability in the SMI callback function that saves and restore boot script tables used for resuming from…
CVE-2020-8333 — Medium (CVSS 6.4): A potential vulnerability in the SMI callback function used in the EEPROM driver in some Lenovo Desktops and…
CVE-2019-6172 — Medium (CVSS 6.4): A potential vulnerability in the SMI callback function used in Legacy USB driver using passed parameter without…
CVE-2019-6170 — Medium (CVSS 6.4): A potential vulnerability in the SMI callback function used in the Legacy USB driver using boot services structure in…

All CVEs affecting Lenovo Thinkcentre E93 Firmware →

Other CWE-665 (Improper Initialization) vulnerabilities

CVE-2021-33635 — Critical (CVSS 9.8): When malicious images are pulled by isula pull, attackers can execute arbitrary code.
CVE-2022-37128 — Critical (CVSS 9.8): In D-Link DIR-816 A2_v1.10CNB04.img the network can be initialized without authentication via /goform/wizard_end.
CVE-2021-41264 — Critical (CVSS 9.8): OpenZeppelin Contracts is a library for smart contract development. In affected versions upgradeable contracts using…
CVE-2019-10196 — Critical (CVSS 9.8): A flaw was found in http-proxy-agent, prior to version 2.1.0. It was discovered http-proxy-agent passes an auth option…
CVE-2015-8367 — Critical (CVSS 9.8): The phase_one_correct function in Libraw before 0.17.1 allows attackers to cause memory errors and possibly execute…
CVE-2019-14271 — Critical (CVSS 9.8): In Docker 19.03.x before 19.03.1 linked against the GNU C Library (aka glibc), code injection can occur when the…

Browse all CWE-665 (Improper Initialization) vulnerabilities →