dbcve.org
B50 10 FirmwareOperating system · Lenovo

CVE-2015-5684

CRITICAL · 9.8 CVSS v3.1 Published 2020-03-27
Mitigation only
No fix yet — a mitigation exists. There is no fixed release. A documented workaround reduces exposure in the meantime.
See remediation →
100/100
Remediation priority · Urgent
Remotely reachable No privileges Zero-click

Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.

NVD · unedited
MITRE is populating this ID because it was assigned prior to Lenovo becoming a CNA. A buffer overflow vulnerability was reported, (fixed and publicly disclosed in 2015) in the Lenovo Service Engine (LSE), affecting various versions of BIOS for Lenovo Notebooks, that could allow a remote user to execute arbitrary code on the system.

Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.

dbcve analysis · moderate confidence

A buffer overflow vulnerability in Lenovo Service Engine (LSE), a firmware component pre-installed on Lenovo notebooks, allows remote attackers to execute arbitrary code due to insufficient input validation. The flaw exists in the BIOS-level software that ships with affected notebook models.

MitigationApply Lenovo BIOS/firmware updates for affected notebook models; the vulnerability was fixed and publicly disclosed in 2015, so ensure all deployed systems have received subsequent BIOS patches from Lenovo's support site.

Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.

Affected products & versions What the vendor confirmedThe version ranges the vendor confirmed as vulnerable. If your version sits inside a range here, treat yourself as exposed until you have upgraded.

NVD · CPE data
B50 10 FirmwareOperating system
Affected:< cccn13ww\(v1.02\)
Flex 2 Pro 15 FirmwareOperating system
Affected:< a9cn46ww< b9cn17ww
Edge 15 FirmwareOperating system
Affected:< a9cn46ww< b9cn17ww
Flex 3 1470 FirmwareOperating system
Affected:< bdcn30ww
Flex 3 1570 FirmwareOperating system
Affected:< bdcn30ww
Flex 3 1120 FirmwareOperating system
Affected:< c0cn25ww
G40 80 FirmwareOperating system
Affected:< b0cn75ww
G50 80 FirmwareOperating system
Affected:< b0cn75ww

CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.

From the vector
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.

dbcve checks

Work through these to decide whether this CVE applies to you.

  1. Identify the exact Lenovo notebook model
    Check the system information in Windows (Win+R, msinfo32) or look for the model label on the bottom of the notebook. Confirm it matches one of the affected models: B50 10, Flex 2 Pro 15, Edge 15, Flex 3 1470, Flex 3 1570, Flex 3 1120, G40 80, or G50 80.
    Affected if The model is one of the listed affected models
  2. Check the current BIOS/firmware version
    Enter the BIOS setup (press F1 or F2 during boot) and look for the BIOS version string under the Main or Information tab. Alternatively, open Windows System Information (msinfo32) and look for BIOS Version, or run the Lenovo System Update / Vantage tool to check for firmware version.
    Affected if The displayed firmware version is lower than the fixed version for your model (cccn13ww(v1.02) for B50 10, a9cn46ww or b9cn17ww for Flex 2 Pro 15/Edge 15, bdcn30ww for Flex 3 1470/1570, c0cn25ww for Flex 3 1120, or b0cn75ww for G40 80/G50 80)
  3. Verify Lenovo Service Engine presence
    Check the BIOS setup menu for entries related to Lenovo Service Engine or LSE under Advanced or Configuration settings. On Windows, open Programs and Features or the Registry (HKLM\SOFTWARE\Lenovo\LSE) to see if LSE software components are installed.
    Affected if Lenovo Service Engine is present or enabled in the BIOS or Windows installation
  4. Compare version against affected ranges
    Use the firmware version identified in step 2 and compare it against all version thresholds that apply to your specific model. Note that some models have multiple version ranges to check (for example, Flex 2 Pro 15 requires checking both a9cn46ww and b9cn17ww).
    Affected if Your firmware version is below ANY of the version thresholds listed for your model, indicating the unpatched BIOS is still in use

You are affected if you have a listed Lenovo notebook model with a BIOS/firmware version lower than the fixed version and Lenovo Service Engine is present on the system.

Generated from the published advisory. Verify against your own configuration.

Check your environment

Paste your version and any relevant configuration and it will be compared against the affected criteria above. Do not include secrets or credentials.

AI-assisted, checked against the advisory. Informational, not a guarantee.

Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.

dbcve · scoped
Mitigation available No clean upgrade yet — mitigate in the meantime
Mitigation

Apply Lenovo BIOS/firmware updates for affected notebook models; the vulnerability was fixed and publicly disclosed in 2015, so ensure all deployed systems have received subsequent BIOS patches from Lenovo's support site.

Recommended fix Moderate confidence

BIOS firmware version cccn13ww(v1.02) or higher for B50 10; a9cn46ww or b9cn17ww or higher for Flex 2 Pro 15/Edge 15; bdcn30ww or higher for Flex 3 1470/1570; c0cn25ww or higher for Flex 3 1120; b0cn75ww or higher for G40 80/G50 80

  1. 1. Identify the exact Lenovo notebook model number from the affected list (B50 10, Flex 2 Pro 15, Edge 15, Flex 3 1470, Flex 3 1570, Flex 3 1120, G40 80, or G50 80)
  2. 2. Visit the Lenovo support website at support.lenovo.com
  3. 3. Enter the specific model number to access the BIOS/firmware download section
  4. 4. Download the latest BIOS firmware version that is greater than or equal to the fixed version for your model: B50 10 requires cccn13ww(v1.02) or higher; Flex 2 Pro 15 and Edge 15 require a9cn46ww or b9cn17ww or higher; Flex 3 1470/1570 require bdcn30ww or higher; Flex 3 1120 requires c0cn25ww or higher; G40 80/G50 80 require b0cn75ww or higher
  5. 5. Follow Lenovo's BIOS update instructions, which typically involve running the BIOS update utility from Windows or creating a bootable USB recovery disk
  6. 6. Ensure the laptop is connected to power during the BIOS update process and do not interrupt the update
Caveat BIOS updates carry risk of system damage if interrupted; ensure stable power connection and do not turn off the system during the update process

Generated from the published advisory — verify against the referenced sources before acting.

Fix this in B50 10 Firmware Scoped from the published advisory
  • Consultation4.0 h
  • Implementation8.0 h
  • Testing6.0 h
  • Review / QA2.0 h
20.0 hours of engineering $3,500
Get help mitigating

An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $5,600.

Scan for this in your stack

Free · runs locally
dbcve dependency scanner

Check whether your project pulls in CVE-2015-5684 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.

Get it on GitHub Scan in the browser

References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.

Primary sources

Practitioner notes

Contributed

Peer-ranked notes from engineers who’ve handled CVE-2015-5684 in production — separate from our analysis above.

No notes yet

Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.

What this is

A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.

What belongs here
  • Verified mitigations, workarounds, and config changes
  • Version or environment caveats, and links to real fixes
  • No weaponised exploit code, or anything meant to cause harm
  • No spam, self-promotion, credentials, or personal data