CVE-2019-6156: Lenovo 330-14igm Firmware

Low severity, CVSS 3.3. EPSS: 0.2% chance of exploitation in the next 30 days.

In Lenovo systems, SMM BIOS Write Protection is used to prevent writes to SPI Flash. While this provides sufficient protection, an additional layer of protection is provided by SPI Protected Range Registers (PRx). Lenovo was notified that after resuming from S3 sleep mode in various versions of BIOS for Lenovo systems, the PRx is not set. This does not impact the SMM BIOS Write Protection, which keeps systems protected.

Affected products

  • Lenovo 330-14igm Firmware: before 7xcn30ww (fixed in 7xcn30ww)
  • Lenovo 330-15igm Firmware: before 7xcn30ww (fixed in 7xcn30ww)
  • Lenovo 510-15ikl Firmware: affected versions not specified
  • Lenovo 510s-08ikl Firmware: affected versions not specified
  • Lenovo 530s-07icb Firmware: affected versions not specified
  • Lenovo AIO300-23isu(c5130) Firmware: before o1lkt46a (fixed in o1lkt46a)
  • Lenovo AIO520-22ikl Firmware: affected versions not specified
  • Lenovo AIO520-22iku Firmware: affected versions not specified
  • Lenovo AIO520-24ikl Firmware: affected versions not specified
  • Lenovo AIO520-24iku Firmware: affected versions not specified
  • Lenovo AIO520-27ikl Firmware: affected versions not specified
  • Lenovo Aio 910-27ish Firmware: before o37kt13a (fixed in o37kt13a)
  • Lenovo Aio y910-27ish Firmware: affected versions not specified
  • Lenovo h50-30g Desktop Firmware: affected versions not specified
  • Lenovo Ideacentre 300-20ish Firmware: affected versions not specified
  • Lenovo Ideacentre 300s-11ish Firmware: affected versions not specified
  • Lenovo Ideacentre 510-15icb Firmware: before o3qkt32a (fixed in o3qkt32a)
  • Lenovo Ideacentre 510a-15icb Firmware: before o3qkt32a (fixed in o3qkt32a)
  • Lenovo Ideacentre 510s-08ish Firmware: affected versions not specified
  • Lenovo Ideacentre 520s-23iku Firmware: before o34kt23a (fixed in o34kt23a)
  • Lenovo Ideacentre 620s-03ikl Firmware: affected versions not specified
  • Lenovo Ideacentre 700 Firmware: before fwkt9aa (fixed in fwkt9aa)
  • Lenovo Ideacentre 720-18icb Firmware: before o3qkt32a (fixed in o3qkt32a)
  • Lenovo Ideacentre 730s-24ikb Firmware: before o3wkt15a (fixed in o3wkt15a)
  • Lenovo Legion c530-19icb Firmware: before o3lkt20a (fixed in o3lkt20a)
  • and 152 more

Published 2019-04-10. Last modified 2026-06-17.