VulnerabilityModified

CVE-2018-9085

A write protection lock bit was left unset after boot on an older generation of Lenovo and IBM System x servers, potentially allowing an attacker with administrator access to modify the subset of flash memory containing Intel Server Platform Services…

MEDIUM 4.9EPSS 0.66%

Does this matter?

Lower severity and a low EPSS score (0.66%). Track it; it rarely justifies an emergency change on its own.

Description

CVSS 3.0: 4.9 MEDIUMCVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
EPSS: 0.66% probability · 52th percentile
Public exploits: None in Exploit-DB
CISA KEV: Not listed
Weakness: CWE-276
Affected: lenovo/flex system x240 m4 firmware · lenovo/flex system x440 m4 firmware · lenovo/system x3750 m4 firmware · ibm/bladecenter hs23 firmware · ibm/bladecenter hs23e firmware · ibm/flex system x220 m4 firmware · ibm/flex system x222 m4 firmware · ibm/flex system x240 m4 firmware · ibm/flex system x280 x6 firmware · ibm/flex system x440 m4 firmware · ibm/flex system x480 x6 firmware · ibm/flex system x880 x6 firmware · ibm/idataplex dx360 m4 firmware · ibm/idataplex dx360 m4 water cooled firmware · ibm/system x3100 m4 firmware · ibm/system x3100 m5 firmware · ibm/system x3250 m4 firmware · ibm/system x3250 m5 firmware · ibm/system x3300 m4 firmware · ibm/system x3500 m4 firmware · +9 more
Source: psirt@lenovo.com

EPSS trend

EPSS 0.7% since 27 October 2026; no change recorded yet. Points are recorded when the score first appears and whenever it moves by a percentage point or more.

References

https://support.lenovo.com/us/en/solutions/LEN-24477Vendor Advisory
https://support.lenovo.com/us/en/solutions/LEN-24477Vendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.