CVE-2016-5247 : The BIOS for Lenovo ThinkCentre E93, M6500t/s, M6600, M6600q, M6600t/s, M73p, M8

The BIOS for Lenovo ThinkCentre E93, M6500t/s, M6600, M6600q, M6600t/s, M73p, M800, M83, M8500t/s, M8600t/s, M900, M93, and M93P devices; ThinkServer RQ940, RS140, TS140, TS240, TS440, and TS540 devices; and ThinkStation E32, P300, and P310 devices might allow local users or physically proximate attackers to bypass the Secure Boot protection mechanism by leveraging an AMI test key.

Published 2016-09-22 15:59:00

Updated 2016-09-23 15:34:06

Source MITRE

View at NVD, CVE.org

Products affected by CVE-2016-5247

Lenovo » Bios » Version: N/A
cpe:2.3:o:lenovo:bios:-:*:*:*:*:*:*:*
Matching versions
When used together with: Lenovo » Thinkcentre E93 » Version: N/A
When used together with: Lenovo » Thinkcentre M6500t/s » Version: N/A
When used together with: Lenovo » Thinkcentre M6600 » Version: N/A
When used together with: Lenovo » Thinkcentre M6600q » Version: N/A
When used together with: Lenovo » Thinkcentre M6600t/s » Version: N/A
When used together with: Lenovo » Thinkcentre M73p » Version: N/A
When used together with: Lenovo » Thinkcentre M800 » Version: N/A
When used together with: Lenovo » Thinkcentre M83 » Version: N/A
When used together with: Lenovo » Thinkcentre M8500t/s » Version: N/A
When used together with: Lenovo » Thinkcentre M8600t/s » Version: N/A
When used together with: Lenovo » Thinkcentre M900 » Version: N/A
When used together with: Lenovo » Thinkcentre M93 » Version: N/A
When used together with: Lenovo » Thinkcentre M93p » Version: N/A
When used together with: Lenovo » Thinkserver Rq940 » Version: N/A
When used together with: Lenovo » Thinkserver Rs140 » Version: N/A
When used together with: Lenovo » Thinkserver Ts140 » Version: N/A
When used together with: Lenovo » Thinkserver Ts240 » Version: N/A
When used together with: Lenovo » Thinkserver Ts440 » Version: N/A
When used together with: Lenovo » Thinkserver Ts540 » Version: N/A
When used together with: Lenovo » Thinkstation E32 » Version: N/A
When used together with: Lenovo » Thinkstation P300 » Version: N/A
When used together with: Lenovo » Thinkstation P310 » Version: N/A

Exploit prediction scoring system (EPSS) score for CVE-2016-5247

EPSS FAQ

0.04%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 6 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2016-5247

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
7.2	HIGH	AV:L/AC:L/Au:N/C:C/I:C/A:C	3.9	10.0	NIST
Access Vector: Local Access Complexity: Low Authentication: None Confidentiality Impact: Complete Integrity Impact: Complete Availability Impact: Complete
7.8	HIGH	CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	1.8	5.9	NIST
Attack Vector: Local Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High

CWE ids for CVE-2016-5247

CWE-254

Assigned by: nvd@nist.gov (Primary)

References for CVE-2016-5247

https://support.lenovo.com/product_security/PS500067

Lenovo Support Homepage
Mitigation;Vendor Advisory
http://www.securityfocus.com/bid/92661

Lenovo Secure Boot CVE-2016-5247 Local Security Bypass Vulnerability
Third Party Advisory

Jump to

Vulnerability Details : CVE-2016-5247

Products affected by CVE-2016-5247

Exploit prediction scoring system (EPSS) score for CVE-2016-5247

CVSS scores for CVE-2016-5247

CWE ids for CVE-2016-5247

References for CVE-2016-5247