« Volver al listado

CVE-2019-6154

Estado: ModificadaAlta (7.8)—

A DLL search path vulnerability was reported in Lenovo Bootable Generator, prior to version Mar-2019, that could allow a malicious user with local access to execute code on the system.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Lenovo — Bootable USB

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2019-6154",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 6.8,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Secondary",
        "source": "psirt@lenovo.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 5.3,
          "attackVector": "LOCAL",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "LOW",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 3.4,
        "exploitabilityScore": 1.8
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 7.8,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "psirt@lenovo.com",
      "affectedData": [
        {
          "vendor": "Lenovo",
          "product": "Lenovo Bootable Generator",
          "versions": [
            {
              "status": "affected",
              "version": "unspecified",
              "lessThan": "Mar-2019",
              "versionType": "custom"
            }
          ]
        }
      ]
    }
  ],
  "published": "2019-04-10T17:29:00.400",
  "references": [
    {
      "url": "https://support.lenovo.com/solutions/LEN-25401",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "psirt@lenovo.com"
    },
    {
      "url": "https://support.lenovo.com/solutions/LEN-25401",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-426"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A DLL search path vulnerability was reported in Lenovo Bootable Generator, prior to version Mar-2019, that could allow a malicious user with local access to execute code on the system."
    },
    {
      "lang": "es",
      "value": "Se informó de una vulnerabilidad en la ruta de búsqueda de DLL en Lenovo Bootable Generator, anterior a la versión Mar-2019, que podría permitir a un usuario malicioso con acceso local ejecute código en el sistema."
    }
  ],
  "lastModified": "2026-06-17T02:38:41.323",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:lenovo:bootable_usb:*:*:*:*:*:windows:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4373A561-D116-4844-8F09-BEB7923ED0DB",
              "versionEndExcluding": "mar-2019"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:lenovo:ideacentre:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "BE2310B3-8DD3-427A-8A0A-B612FA3FE132"
            },
            {
              "criteria": "cpe:2.3:h:lenovo:thinkcentre:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "A0E8DBDC-AA46-4DF0-B557-275DB8CF3CD6"
            },
            {
              "criteria": "cpe:2.3:h:lenovo:thinkpad:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "E7BD24F8-2446-4657-A1A1-B6DDF52D2250"
            },
            {
              "criteria": "cpe:2.3:h:lenovo:thinkstation:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "8A7A1F41-8BA5-4A8B-80DA-24A4C43FCF21"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "sourceIdentifier": "psirt@lenovo.com"
}