Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
4.4

Lenovo BIOS lets admin bypass Intel Management Engine

CVE-2016-8224 · published 9 years ago
Summary

Certain Lenovo notebook and ThinkServer computers with older BIOS versions can be tricked by someone who already has administrator rights to install software that gets around the Intel Management Engine, a low‑level security component in the hardware. This could let the attacker cause the system to stop working or gain higher privileges. Install the latest BIOS firmware from Lenovo and limit administrative access to trusted personnel.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
lenovo bios All versions
cpe:2.3:o:lenovo:bios:-:*:*:*:*:*:*:*
lenovo notebook_110_14ibr_bios All versions
cpe:2.3:o:lenovo:notebook_110_14ibr_bios:-:*:*:*:*:*:*:*
lenovo notebook_110_15ibr_bios All versions
cpe:2.3:o:lenovo:notebook_110_15ibr_bios:-:*:*:*:*:*:*:*
lenovo notebook_b70_80_bios All versions
cpe:2.3:o:lenovo:notebook_b70_80_bios:-:*:*:*:*:*:*:*
lenovo notebook_e31_80_bios All versions
cpe:2.3:o:lenovo:notebook_e31_80_bios:-:*:*:*:*:*:*:*
lenovo notebook_e40_80_bios All versions
cpe:2.3:o:lenovo:notebook_e40_80_bios:-:*:*:*:*:*:*:*
lenovo notebook_e41_80_bios All versions
cpe:2.3:o:lenovo:notebook_e41_80_bios:-:*:*:*:*:*:*:*
lenovo notebook_e51_80_bios All versions
cpe:2.3:o:lenovo:notebook_e51_80_bios:-:*:*:*:*:*:*:*
lenovo notebook_g40_80_bios All versions
cpe:2.3:o:lenovo:notebook_g40_80_bios:-:*:*:*:*:*:*:*
lenovo notebook_g50_80_bios All versions
cpe:2.3:o:lenovo:notebook_g50_80_bios:-:*:*:*:*:*:*:*
lenovo notebook_g50_80_touch_bios All versions
cpe:2.3:o:lenovo:notebook_g50_80_touch_bios:-:*:*:*:*:*:*:*
lenovo notebook_ideapad_300_14ibr_bios All versions
cpe:2.3:o:lenovo:notebook_ideapad_300_14ibr_bios:-:*:*:*:*:*:*:*
lenovo notebook_ideapad_300_14isk_bios All versions
cpe:2.3:o:lenovo:notebook_ideapad_300_14isk_bios:-:*:*:*:*:*:*:*
lenovo notebook_ideapad_300_15ibr_bios All versions
cpe:2.3:o:lenovo:notebook_ideapad_300_15ibr_bios:-:*:*:*:*:*:*:*
lenovo notebook_ideapad_300_15isk_bios All versions
cpe:2.3:o:lenovo:notebook_ideapad_300_15isk_bios:-:*:*:*:*:*:*:*
lenovo notebook_ideapad_300_17isk_bios All versions
cpe:2.3:o:lenovo:notebook_ideapad_300_17isk_bios:-:*:*:*:*:*:*:*
lenovo notebook_ideapad_510s_12isk_bios All versions
cpe:2.3:o:lenovo:notebook_ideapad_510s_12isk_bios:-:*:*:*:*:*:*:*
lenovo notebook_k21_80_bios All versions
cpe:2.3:o:lenovo:notebook_k21_80_bios:-:*:*:*:*:*:*:*
lenovo notebook_k41_80_bios All versions
cpe:2.3:o:lenovo:notebook_k41_80_bios:-:*:*:*:*:*:*:*
lenovo notebook_miix_710_12ikb_bios All versions
cpe:2.3:o:lenovo:notebook_miix_710_12ikb_bios:-:*:*:*:*:*:*:*
lenovo notebook_xiaoxin_air_12_bios All versions
cpe:2.3:o:lenovo:notebook_xiaoxin_air_12_bios:-:*:*:*:*:*:*:*
lenovo notebook_yoga_510_14isk_bios All versions
cpe:2.3:o:lenovo:notebook_yoga_510_14isk_bios:-:*:*:*:*:*:*:*
lenovo notebook_yoga_510_15isk_bios All versions
cpe:2.3:o:lenovo:notebook_yoga_510_15isk_bios:-:*:*:*:*:*:*:*
lenovo notebook_yoga_710_11ikb_bios All versions
cpe:2.3:o:lenovo:notebook_yoga_710_11ikb_bios:-:*:*:*:*:*:*:*
lenovo notebook_yoga_710_11isk_bios All versions
cpe:2.3:o:lenovo:notebook_yoga_710_11isk_bios:-:*:*:*:*:*:*:*
lenovo notebook_yoga_900_13isk_bios All versions
cpe:2.3:o:lenovo:notebook_yoga_900_13isk_bios:-:*:*:*:*:*:*:*
lenovo notebook_yoga_900s_12isk_bios All versions
cpe:2.3:o:lenovo:notebook_yoga_900s_12isk_bios:-:*:*:*:*:*:*:*
lenovo thinkserver_ts150_bios All versions
cpe:2.3:o:lenovo:thinkserver_ts150_bios:-:*:*:*:*:*:*:*
lenovo thinkserver_ts450_bios All versions
cpe:2.3:o:lenovo:thinkserver_ts450_bios:-:*:*:*:*:*:*:*
Original advisory text
A vulnerability has been identified in some Lenovo Notebook and ThinkServer systems where an attacker with administrative privileges on a system could install a program that circumvents Intel Manag...
A vulnerability has been identified in some Lenovo Notebook and ThinkServer systems where an attacker with administrative privileges on a system could install a program that circumvents Intel Management Engine (ME) protections. This could result in a denial of service or privilege escalation attack on the system.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker partial control (estimated)
Severity
4.4 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-310Cryptographic Issues
Timeline
Published29 Nov 2016
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2016-8224 · NVD
Track software like this
Free during beta