Is CVE-2018-9085 in the CISA KEV catalog?

No. CVE-2018-9085 is not currently on the CISA Known Exploited Vulnerabilities list.

What is the CVSS severity of CVE-2018-9085?

CVE-2018-9085 has a CVSS v3 base score of 4.9 (MEDIUM).

What is the EPSS score for CVE-2018-9085?

CVE-2018-9085 has an EPSS score of 0.66% (47th percentile), estimating the probability of exploitation in the next 30 days.

How do I fix CVE-2018-9085?

Upgrade bladecenter hs23 firmware to tke160c or later. Fixes are available for 26 affected products.

CVE & CISA-KEV Catalog

CVE-2018-9085

MEDIUM

4.9

CVSS v3

NVD

Description

A write protection lock bit was left unset after boot on an older generation of Lenovo and IBM System x servers, potentially allowing an attacker with administrator access to modify the subset of flash memory containing Intel Server Platform Services (SPS) and the system Flash Descriptors.

CWE-276

How to fix

Remediation Available

bladecenter hs23 firmwareNVD

Affected:< tke160cFixed in:tke160cCVE-2018-9085derived from NVD

bladecenter hs23e firmwareNVD

Affected:< ahe160cFixed in:ahe160cCVE-2018-9085derived from NVD

flex system x220 m4 firmwareNVD

Affected:< kse158cFixed in:kse158cCVE-2018-9085derived from NVD

flex system x222 m4 firmwareNVD

Affected:< cce160cFixed in:cce160cCVE-2018-9085derived from NVD

flex system x240 m4 firmwareNVD

Affected:< ahe160cFixed in:ahe160cCVE-2018-9085derived from NVD

Affected:< a3e122bFixed in:a3e122bCVE-2018-9085derived from NVD

flex system x280 x6 firmwareNVD

Affected:< n3e132wFixed in:n3e132wCVE-2018-9085derived from NVD

flex system x440 m4 firmwareNVD

Affected:< cge122bFixed in:cge122bCVE-2018-9085derived from NVD

Affected:< cne162dFixed in:cne162dCVE-2018-9085derived from NVD

flex system x480 x6 firmwareNVD

Affected:< n3e132wFixed in:n3e132wCVE-2018-9085derived from NVD

flex system x880 x6 firmwareNVD

Affected:< n2e130eFixed in:n2e130eCVE-2018-9085derived from NVD

idataplex dx360 m4 firmwareNVD

Affected:< fhe120dFixed in:fhe120dCVE-2018-9085derived from NVD

idataplex dx360 m4 water cooled firmwareNVD

Affected:< fhe120dFixed in:fhe120dCVE-2018-9085derived from NVD

system x3100 m4 firmwareNVD

Affected:< jqe184cFixed in:jqe184cCVE-2018-9085derived from NVD

system x3100 m5 firmwareNVD

Affected:< j9e134cFixed in:j9e134cCVE-2018-9085derived from NVD

system x3250 m4 firmwareNVD

Affected:< jqe184cFixed in:jqe184cCVE-2018-9085derived from NVD

system x3250 m5 firmwareNVD

Affected:< jue134cFixed in:jue134cCVE-2018-9085derived from NVD

system x3300 m4 firmwareNVD

Affected:< yae156cFixed in:yae156cCVE-2018-9085derived from NVD

system x3500 m4 firmwareNVD

Affected:< y5e158cFixed in:y5e158cCVE-2018-9085derived from NVD

system x3530 m4 firmwareNVD

Affected:< bee164cFixed in:bee164cCVE-2018-9085derived from NVD

system x3550 m4 firmwareNVD

Affected:< d7e166dFixed in:d7e166dCVE-2018-9085derived from NVD

system x3630 m4 firmwareNVD

Affected:< vve162cFixed in:vve162cCVE-2018-9085derived from NVD

system x3650 m4 bd firmwareNVD

Affected:< vve160cFixed in:vve160cCVE-2018-9085derived from NVD

system x3650 m4 firmwareNVD

Affected:< vve160cFixed in:vve160cCVE-2018-9085derived from NVD

system x3650 m4 hd firmwareNVD

Affected:< vve160cFixed in:vve160cCVE-2018-9085derived from NVD

system x3750 m4 firmwareNVD

Affected:< a5e124bFixed in:a5e124bCVE-2018-9085derived from NVD

Affected:< koe160cFixed in:koe160cCVE-2018-9085derived from NVD

system x3850 x6 firmwareNVD

Affected:< a8e128cFixed in:a8e128cCVE-2018-9085derived from NVD

system x3950 x6 firmwareNVD

Affected:< bee164cFixed in:bee164cCVE-2018-9085derived from NVD

Remediation is compiled from vendor and distribution security advisories. Always confirm against the linked source for your exact version and platform.

CVSS v3 Vector

Exploitability

Attack VectorNetwork

Attack ComplexityLow

Privileges RequiredHigh

User InteractionNone

ScopeUnchanged

Impact

ConfidentialityNone

IntegrityHigh

AvailabilityNone

CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N

Exploit Intelligence

0.66%probability of exploitation in 30 days

47thpercentile

Moderate risk: more likely to be exploited than 47% of all known CVEs.

References

Vendor Advisory1

support.lenovo.com

Related Vulnerabilities

Other CWE-276 vulnerabilities, ordered by exploit likelihood. View all

CVE	Severity	CVSS	EPSS	Exploited	Fix
CVE-2013-0632	Critical	9.8	94%	KEV	-
CVE-2017-11610	High	8.8	88%	-	Fix
CVE-2023-29919	Critical	9.1	60%	-	-
CVE-2019-17124	Critical	9.8	23%	-	-
CVE-2020-12608	High	7.8	22%	-	Fix
CVE-2021-3437	Critical	9.8	16%	-	Fix

Embed a live status badge for CVE-2018-9085

Markdown

[![CVE-2018-9085](https://tridentstack.com/cve/badge/CVE-2018-9085.svg)](https://tridentstack.com/cve/CVE-2018-9085)

HTML

<a href="https://tridentstack.com/cve/CVE-2018-9085"><img src="https://tridentstack.com/cve/badge/CVE-2018-9085.svg" alt="CVE-2018-9085"></a>

Find and fix vulnerabilities across your fleet

TridentStack Control continuously scans your Windows, macOS, and Linux fleet for known vulnerabilities, prioritizes them by severity and active exploitation, and patches them automatically.

Start free

This product uses NVD data but is not endorsed or certified by the NVD. EPSS scores courtesy of FIRST.org (https://www.first.org/epss). Source: CISA KEV Catalog. Data as of 2024-11-21.