HighCVE-2019-19705

    Lenovo ThinkPad X1 Carbon Firmware: security vulnerability (CVE-2019-19705)

    Published Sources: CVE.org

    What is affected, what to do

    Realtek Audio Drivers for Windows, as used on the Lenovo ThinkPad X1 Carbon 20A7, 20A8, 20BS, and 20BT before 6.0.8882.1 and 20KH and 20KG before 6.0.8907.1 (and on many other Lenovo and non-Lenovo products), mishandles DLL preloading.

    Update Lenovo Ideacentre 510-15ikl Firmware to version 6.0.8923.1, Lenovo Ideacentre 510s-08ikl Firmware to version 6.0.8923.1, Lenovo IdeaCentre 300s-11ish Firmware to version 6.0.8924.1.

    Affected
    • Lenovo Ideacentre 510-15ikl Firmware lt *..6.0.8923.1
    • Lenovo Ideacentre 510s-08ikl Firmware lt *..6.0.8923.1
    • Lenovo IdeaCentre 300s-11ish Firmware lt *..6.0.8924.1
    • Lenovo Ideacentre 310-15asr Firmware lt *..6.0.8924.1
    • Lenovo Ideacentre 310-15iap Firmware lt *..6.0.8924.1
    • Lenovo Ideacentre 310a-15iap Firmware lt *..6.0.8924.1
    • Lenovo Ideacentre 310s-08iap Firmware lt *..6.0.8924.1
    • Lenovo Ideacentre 510-15abr Firmware lt *..6.0.8924.1
    • Lenovo IdeaCentre 510s-08ish Firmware lt *..6.0.8924.1
    • Lenovo Ideacentre 610s-02ish Firmware lt *..6.0.8924.1
    • Lenovo Ideacentre 620s-03ikl Firmware lt *..6.0.8924.1
    • Lenovo IdeaCentre 700 Firmware lt *..6.0.8924.1
    • Lenovo Ideacentre 720-18asr Firmware lt *..6.0.8924.1
    • Lenovo Legion Y520t Z370 Firmware lt *..6.0.8924.1
    • Lenovo Legion Y720 Tower Firmware lt *..6.0.8924.1
    • Lenovo Legion Y720t Amd Firmware lt *..6.0.8924.1
    • Lenovo Legion Y920 Tower Firmware lt *..6.0.8924.1
    • Lenovo V320-15iap Firmware lt *..6.0.8924.1
    • Lenovo ThinkCentre E74s Firmware lt *..6.0.8924.1
    • Lenovo YANGTIAN Mc H110 Firmware lt *..6.0.8924.1
    • Lenovo YANGTIAN Me/we H110 Firmware lt *..6.0.8924.1
    • Lenovo Yangtian Tc/wc H110 Pci Firmware lt *..6.0.8924.1
    • Lenovo Yangtian Ytm6900e-00 Firmwar lt *..6.0.8924.1
    • Lenovo Yta8900f Firmware lt *..6.0.8924.1
    • Lenovo ThinkCentre M6600 Firmware lt *..6.0.8924.1
    • Lenovo ThinkCentre M6600q Firmware lt *..6.0.8924.1
    • Lenovo ThinkCentre M6600t/s Firmware lt *..6.0.8924.1
    • Lenovo Thinkcentre M700q Firmware lt *..6.0.8924.1
    • Lenovo Thinkcentre M700t\/s Firmware lt *..6.0.8924.1
    • Lenovo Thinkcentre M710e Firmware lt *..6.0.8924.1
    • Lenovo Thinkcentre M710q Firmware lt *..6.0.8924.1
    • Lenovo ThinkCentre M710t/s Firmware lt *..6.0.8924.1
    • Lenovo ThinkCentre M715q Firmware lt *..6.0.8924.1
    • Lenovo Thinkcentre M715t\/s Firmware lt *..6.0.8924.1
    • Lenovo ThinkCentre M800 Firmware lt *..6.0.8924.1
    • Lenovo ThinkCentre M8600t/s Firmware lt *..6.0.8924.1
    • Lenovo ThinkCentre M900 Firmware lt *..6.0.8924.1
    • Lenovo Thinkcentre M910 T\/s Firmware lt *..6.0.8924.1
    • Lenovo ThinkCentre M910q Firmware lt *..6.0.8924.1
    • Lenovo ThinkCentre M910x Firmware lt *..6.0.8924.1
    • Lenovo YANGTIAN Afh110 Firmware lt *..6.0.8924.1
    • Lenovo YANGTIAN Afq150 Firmware lt *..6.0.8924.1
    • Lenovo Yangtian Mc H110 Pci Firmware lt *..6.0.8924.1
    • Lenovo Yangtian Mf/wf H110 Pci Firmware lt *..6.0.8924.1
    • Lenovo Aio 910-27ish Firmware lt *..6.0.8924.1
    • Lenovo Aio Y910-27ish Firmware lt *..6.0.8881.1
    • Lenovo Aio300-23isu Firmware lt *..6.0.8881.1
    • Lenovo AIO310-20IAP Firmware lt *..6.0.8881.1
    • Lenovo AIO510-22ISH Firmware lt *..6.0.8881.1
    • Lenovo AIO510-23ISH Firmware lt *..6.0.8881.1
    • Lenovo Aio520-22ikl Firmware lt *..6.0.8881.1
    • Lenovo AIO520-22IKU Firmware lt *..6.0.8881.1
    • Lenovo Aio520-24ikl Firmware lt *..6.0.8881.1
    • Lenovo AIO520-24IKU Firmware lt *..6.0.8881.1
    • Lenovo Aio520-27ikl Firmware lt *..6.0.8881.1
    • Lenovo AIO720-24IKB Firmware lt *..6.0.8881.1
    • Lenovo Ideacentre 520s-23iku Firmware lt *..6.0.8881.1
    • Lenovo Qt A7400 Firmware lt *..6.0.8924.1
    • Lenovo Sydney E3 H110 Firmware lt *..6.0.8924.1
    • Lenovo ThinkCentre E74z Firmware lt *..6.0.8924.1
    • Lenovo Thinkcentre E95z Firmware lt *..6.0.8881.1
    • Lenovo ThinkCentre M700z Firmware lt *..6.0.8924.1
    • Lenovo ThinkCentre M7300z Firmware lt *..6.0.8924.1
    • Lenovo ThinkCentre M800z Firmware lt *..6.0.8924.1
    • Lenovo ThinkCentre M810z Firmware lt *..6.0.8924.1
    • Lenovo ThinkCentre M818z Firmware lt *..6.0.8881.1
    • Lenovo ThinkCentre M8300z Firmware lt *..6.0.8924.1
    • Lenovo ThinkCentre M8350z Firmware lt *..6.0.8924.1
    • Lenovo ThinkCentre M900z Firmware lt *..6.0.8881.1
    • Lenovo ThinkCentre M910z Firmware lt *..6.0.8881.1
    • Lenovo ThinkCentre M9500z Firmware lt *..6.0.8881.1
    • Lenovo ThinkCentre M9550z Firmware lt *..6.0.8881.1
    • Lenovo ThinkCentre X1 Aio Firmware lt *..6.0.8924.1
    • Lenovo V310z(yt S3150) Firmware lt *..6.0.8924.1
    • Lenovo V410z (YT S4250) Firmware lt *..6.0.8881.1
    • Lenovo V510z (yt S5250) Firmware lt *..6.0.8881.1
    • Lenovo Yangtian S4150 Firmware lt *..6.0.8881.1
    • Lenovo ThinkStation P310 Firmware lt *..6.0.8924.1
    • Lenovo Thinkstation P318 Firmware lt *..6.0.8924.1
    • Lenovo ThinkStation P320 Firmware lt *..6.0.8924.1
    • Lenovo Thinkstation P320 Tiny Firmware lt *..6.0.8924.1
    • Lenovo Thinkstation P330 Firmware lt *..6.0.8923.1
    • Lenovo Thinkstation P330 Tiny Firmware lt *..6.0.8923.1
    • Lenovo ThinkServer TS140 Firmware lt *..6.0.1.7016
    • Lenovo ThinkServer TS150 Firmware lt *..6.0.1.7525
    • Lenovo ThinkServer TS240 Firmware lt *..6.0.1.7016
    • Lenovo ThinkServer TS250 Firmware lt *..6.0.1.7525
    • Lenovo ThinkServer TS450 Firmware lt *..6.0.1.7525
    • Lenovo ThinkServer TS550 Firmware lt *..6.0.1.7525
    • Lenovo Thinkpad Yoga 11e 3rd Gen Firmware lt *..6.0.8924.1
    • Lenovo Thinkpad Yoga 11e 4th Gen Firmware lt *..6.0.8924.1
    • Lenovo ThinkPad 13 Firmware lt *..6.0.8924.1
    • Lenovo ThinkPad A275 Firmware lt *..6.0.8924.1
    • Lenovo ThinkPad A475 Firmware lt *..6.0.8924.1
    • Lenovo Thinkpad L13 Yoga Firmware lt *..9.0.280.80
    • Lenovo ThinkPad L380 Firmware lt *..6.0.8882.1
    • Lenovo ThinkPad S3 3rd Gen Firmware lt *..6.0.8882.1
    • Lenovo ThinkPad L380 Yoga Firmware lt *..6.0.8882.1
    • Lenovo ThinkPad S2 Yoga 3rd Gen Firmware lt *..6.0.8882.1
    • Lenovo ThinkPad L390 Yoga Firmware lt *..6.0.8757.1
    • Lenovo ThinkPad S2 Yoga 4th Gen Firmware lt *..6.0.8757.1
    • Lenovo ThinkPad L450 Firmware lt *..6.0.8924.1
    • Lenovo ThinkPad L460 Firmware lt *..6.0.8924.1
    • Lenovo ThinkPad L470 Firmware lt *..6.0.8924.1
    • Lenovo Thinkpad L480 Firmware lt *..6.0.8924.1
    • Lenovo Thinkpad L580 Firmware lt *..6.0.8924.1
    • Lenovo ThinkPad L560 Firmware lt *..6.0.8899.1
    • Lenovo ThinkPad L570 Firmware lt *..6.0.8899.1
    • Lenovo ThinkPad P50 Firmware lt *..6.0.8882.1
    • Lenovo ThinkPad P50s Firmware lt *..6.0.8882.1
    • Lenovo ThinkPad P51 Firmware lt *..6.0.8904.1
    • Lenovo ThinkPad P51s Firmware lt *..6.0.8882.1
    • Lenovo ThinkPad P52s Firmware lt *..6.0.8882.1
    • Lenovo ThinkPad P70 Firmware lt *..6.0.8882.1
    • Lenovo ThinkPad P71 Firmware lt *..6.0.8924.1
    • Lenovo ThinkPad T25 Firmware lt *..6.0.8924.1
    • Lenovo ThinkPad T450 Firmware lt *..6.0.8924.1
    • Lenovo ThinkPad T450s Firmware lt *..6.0.8924.1
    • Lenovo Thinkpad T460 Firmware lt *..6.0.8924.1
    • Lenovo Thinkpad T460p Firmware lt *..6.0.8924.1
    • Lenovo ThinkPad T460s Firmware lt *..6.0.8882.1
    • Lenovo ThinkPad T470 Firmware lt *..6.0.8924.1
    • Lenovo Thinkpad T470p Firmware lt *..6.0.8924.1
    • Lenovo ThinkPad T470s Firmware lt *..6.0.8777.1
    • Lenovo ThinkPad T480 Firmware lt *..6.0.8924.1
    • Lenovo ThinkPad T480s Firmware lt *..6.0.8907.1
    • Lenovo ThinkPad T560 Firmware lt *..6.0.8882.1
    • Lenovo ThinkPad T570 Firmware lt *..6.0.8882.1
    • Lenovo ThinkPad T580 Firmware lt *..6.0.8882.1
    • Lenovo ThinkPad X1 Carbon Firmware lt *..6.0.8907.1
    • Lenovo ThinkPad X1 Tablet Firmware lt *..6.0.8882.1
    • Lenovo ThinkPad X1 Yoga Firmware lt *..6.0.8882.1
    • Lenovo ThinkPad X250 Firmware lt *..6.0.8882.1
    • Lenovo Thinkpad X260 Firmware lt *..6.0.8924.1
    • Lenovo Thinkpad X270 Firmware lt *..6.0.8924.1
    • Lenovo ThinkPad X280 Firmware lt *..6.0.8882.1
    • Lenovo ThinkPad X1 Carbon Firmware lt *..6.0.8882.1
    • Lenovo ThinkPad X1 Tablet Firmware lt *..6.0.8907.1
    Fixed in
    • Lenovo Ideacentre 510-15ikl Firmware 6.0.8923.1
    • Lenovo Ideacentre 510s-08ikl Firmware 6.0.8923.1
    • Lenovo IdeaCentre 300s-11ish Firmware 6.0.8924.1
    • Lenovo Ideacentre 310-15asr Firmware 6.0.8924.1
    • Lenovo Ideacentre 310-15iap Firmware 6.0.8924.1
    • Lenovo Ideacentre 310a-15iap Firmware 6.0.8924.1
    • Lenovo Ideacentre 310s-08iap Firmware 6.0.8924.1
    • Lenovo Ideacentre 510-15abr Firmware 6.0.8924.1
    • Lenovo IdeaCentre 510s-08ish Firmware 6.0.8924.1
    • Lenovo Ideacentre 610s-02ish Firmware 6.0.8924.1
    • Lenovo Ideacentre 620s-03ikl Firmware 6.0.8924.1
    • Lenovo IdeaCentre 700 Firmware 6.0.8924.1
    • Lenovo Ideacentre 720-18asr Firmware 6.0.8924.1
    • Lenovo Legion Y520t Z370 Firmware 6.0.8924.1
    • Lenovo Legion Y720 Tower Firmware 6.0.8924.1
    • Lenovo Legion Y720t Amd Firmware 6.0.8924.1
    • Lenovo Legion Y920 Tower Firmware 6.0.8924.1
    • Lenovo V320-15iap Firmware 6.0.8924.1
    • Lenovo ThinkCentre E74s Firmware 6.0.8924.1
    • Lenovo YANGTIAN Mc H110 Firmware 6.0.8924.1
    • Lenovo YANGTIAN Me/we H110 Firmware 6.0.8924.1
    • Lenovo Yangtian Tc/wc H110 Pci Firmware 6.0.8924.1
    • Lenovo Yangtian Ytm6900e-00 Firmwar 6.0.8924.1
    • Lenovo Yta8900f Firmware 6.0.8924.1
    • Lenovo ThinkCentre M6600 Firmware 6.0.8924.1
    • Lenovo ThinkCentre M6600q Firmware 6.0.8924.1
    • Lenovo ThinkCentre M6600t/s Firmware 6.0.8924.1
    • Lenovo Thinkcentre M700q Firmware 6.0.8924.1
    • Lenovo Thinkcentre M700t\/s Firmware 6.0.8924.1
    • Lenovo Thinkcentre M710e Firmware 6.0.8924.1
    • Lenovo Thinkcentre M710q Firmware 6.0.8924.1
    • Lenovo ThinkCentre M710t/s Firmware 6.0.8924.1
    • Lenovo ThinkCentre M715q Firmware 6.0.8924.1
    • Lenovo Thinkcentre M715t\/s Firmware 6.0.8924.1
    • Lenovo ThinkCentre M800 Firmware 6.0.8924.1
    • Lenovo ThinkCentre M8600t/s Firmware 6.0.8924.1
    • Lenovo ThinkCentre M900 Firmware 6.0.8924.1
    • Lenovo Thinkcentre M910 T\/s Firmware 6.0.8924.1
    • Lenovo ThinkCentre M910q Firmware 6.0.8924.1
    • Lenovo ThinkCentre M910x Firmware 6.0.8924.1
    • Lenovo YANGTIAN Afh110 Firmware 6.0.8924.1
    • Lenovo YANGTIAN Afq150 Firmware 6.0.8924.1
    • Lenovo Yangtian Mc H110 Pci Firmware 6.0.8924.1
    • Lenovo Yangtian Mf/wf H110 Pci Firmware 6.0.8924.1
    • Lenovo Aio 910-27ish Firmware 6.0.8924.1
    • Lenovo Aio Y910-27ish Firmware 6.0.8881.1
    • Lenovo Aio300-23isu Firmware 6.0.8881.1
    • Lenovo AIO310-20IAP Firmware 6.0.8881.1
    • Lenovo AIO510-22ISH Firmware 6.0.8881.1
    • Lenovo AIO510-23ISH Firmware 6.0.8881.1
    • Lenovo Aio520-22ikl Firmware 6.0.8881.1
    • Lenovo AIO520-22IKU Firmware 6.0.8881.1
    • Lenovo Aio520-24ikl Firmware 6.0.8881.1
    • Lenovo AIO520-24IKU Firmware 6.0.8881.1
    • Lenovo Aio520-27ikl Firmware 6.0.8881.1
    • Lenovo AIO720-24IKB Firmware 6.0.8881.1
    • Lenovo Ideacentre 520s-23iku Firmware 6.0.8881.1
    • Lenovo Qt A7400 Firmware 6.0.8924.1
    • Lenovo Sydney E3 H110 Firmware 6.0.8924.1
    • Lenovo ThinkCentre E74z Firmware 6.0.8924.1
    • Lenovo Thinkcentre E95z Firmware 6.0.8881.1
    • Lenovo ThinkCentre M700z Firmware 6.0.8924.1
    • Lenovo ThinkCentre M7300z Firmware 6.0.8924.1
    • Lenovo ThinkCentre M800z Firmware 6.0.8924.1
    • Lenovo ThinkCentre M810z Firmware 6.0.8924.1
    • Lenovo ThinkCentre M818z Firmware 6.0.8881.1
    • Lenovo ThinkCentre M8300z Firmware 6.0.8924.1
    • Lenovo ThinkCentre M8350z Firmware 6.0.8924.1
    • Lenovo ThinkCentre M900z Firmware 6.0.8881.1
    • Lenovo ThinkCentre M910z Firmware 6.0.8881.1
    • Lenovo ThinkCentre M9500z Firmware 6.0.8881.1
    • Lenovo ThinkCentre M9550z Firmware 6.0.8881.1
    • Lenovo ThinkCentre X1 Aio Firmware 6.0.8924.1
    • Lenovo V310z(yt S3150) Firmware 6.0.8924.1
    • Lenovo V410z (YT S4250) Firmware 6.0.8881.1
    • Lenovo V510z (yt S5250) Firmware 6.0.8881.1
    • Lenovo Yangtian S4150 Firmware 6.0.8881.1
    • Lenovo ThinkStation P310 Firmware 6.0.8924.1
    • Lenovo Thinkstation P318 Firmware 6.0.8924.1
    • Lenovo ThinkStation P320 Firmware 6.0.8924.1
    • Lenovo Thinkstation P320 Tiny Firmware 6.0.8924.1
    • Lenovo Thinkstation P330 Firmware 6.0.8923.1
    • Lenovo Thinkstation P330 Tiny Firmware 6.0.8923.1
    • Lenovo ThinkServer TS140 Firmware 6.0.1.7016
    • Lenovo ThinkServer TS150 Firmware 6.0.1.7525
    • Lenovo ThinkServer TS240 Firmware 6.0.1.7016
    • Lenovo ThinkServer TS250 Firmware 6.0.1.7525
    • Lenovo ThinkServer TS450 Firmware 6.0.1.7525
    • Lenovo ThinkServer TS550 Firmware 6.0.1.7525
    • Lenovo Thinkpad Yoga 11e 3rd Gen Firmware 6.0.8924.1
    • Lenovo Thinkpad Yoga 11e 4th Gen Firmware 6.0.8924.1
    • Lenovo ThinkPad 13 Firmware 6.0.8924.1
    • Lenovo ThinkPad A275 Firmware 6.0.8924.1
    • Lenovo ThinkPad A475 Firmware 6.0.8924.1
    • Lenovo Thinkpad L13 Yoga Firmware 9.0.280.80
    • Lenovo ThinkPad L380 Firmware 6.0.8882.1
    • Lenovo ThinkPad S3 3rd Gen Firmware 6.0.8882.1
    • Lenovo ThinkPad L380 Yoga Firmware 6.0.8882.1
    • Lenovo ThinkPad S2 Yoga 3rd Gen Firmware 6.0.8882.1
    • Lenovo ThinkPad L390 Yoga Firmware 6.0.8757.1
    • Lenovo ThinkPad S2 Yoga 4th Gen Firmware 6.0.8757.1
    • Lenovo ThinkPad L450 Firmware 6.0.8924.1
    • Lenovo ThinkPad L460 Firmware 6.0.8924.1
    • Lenovo ThinkPad L470 Firmware 6.0.8924.1
    • Lenovo Thinkpad L480 Firmware 6.0.8924.1
    • Lenovo Thinkpad L580 Firmware 6.0.8924.1
    • Lenovo ThinkPad L560 Firmware 6.0.8899.1
    • Lenovo ThinkPad L570 Firmware 6.0.8899.1
    • Lenovo ThinkPad P50 Firmware 6.0.8882.1
    • Lenovo ThinkPad P50s Firmware 6.0.8882.1
    • Lenovo ThinkPad P51 Firmware 6.0.8904.1
    • Lenovo ThinkPad P51s Firmware 6.0.8882.1
    • Lenovo ThinkPad P52s Firmware 6.0.8882.1
    • Lenovo ThinkPad P70 Firmware 6.0.8882.1
    • Lenovo ThinkPad P71 Firmware 6.0.8924.1
    • Lenovo ThinkPad T25 Firmware 6.0.8924.1
    • Lenovo ThinkPad T450 Firmware 6.0.8924.1
    • Lenovo ThinkPad T450s Firmware 6.0.8924.1
    • Lenovo Thinkpad T460 Firmware 6.0.8924.1
    • Lenovo Thinkpad T460p Firmware 6.0.8924.1
    • Lenovo ThinkPad T460s Firmware 6.0.8882.1
    • Lenovo ThinkPad T470 Firmware 6.0.8924.1
    • Lenovo Thinkpad T470p Firmware 6.0.8924.1
    • Lenovo ThinkPad T470s Firmware 6.0.8777.1
    • Lenovo ThinkPad T480 Firmware 6.0.8924.1
    • Lenovo ThinkPad T480s Firmware 6.0.8907.1
    • Lenovo ThinkPad T560 Firmware 6.0.8882.1
    • Lenovo ThinkPad T570 Firmware 6.0.8882.1
    • Lenovo ThinkPad T580 Firmware 6.0.8882.1
    • Lenovo ThinkPad X1 Carbon Firmware 6.0.8907.1
    • Lenovo ThinkPad X1 Tablet Firmware 6.0.8882.1
    • Lenovo ThinkPad X1 Yoga Firmware 6.0.8882.1
    • Lenovo ThinkPad X250 Firmware 6.0.8882.1
    • Lenovo Thinkpad X260 Firmware 6.0.8924.1
    • Lenovo Thinkpad X270 Firmware 6.0.8924.1
    • Lenovo ThinkPad X280 Firmware 6.0.8882.1
    • Lenovo ThinkPad X1 Carbon Firmware 6.0.8882.1
    • Lenovo ThinkPad X1 Tablet Firmware 6.0.8907.1

    Not sure whether and how you are affected? Ask a question about this vulnerability

    Metrics

    7.8

    Priority

    XIEM Effective CVSS: highest available CVSS rating from NVD and vendor data.

    Source: NVD, CVSS v3

    7.8

    CVSS v3

    Severity High on the scale from 0 to 10.

    Source: CVE.org

    0.2 %

    EPSS score

    Low — model estimates < 1% exploitation likelihood.

    Source: FIRST EPSS, percentile 11.2

    Show all metrics
    Severity
    High
    Priority (0–325)

    The priority score is a consolidated metric that condenses several individual signals into a single, action-guiding ranking: technical severity (CVSS), exploitation likelihood (EPSS), known-exploited status (KEV) and the context of the affected asset. The aim is to answer the only truly important question in vulnerability management: what first?

    Read in glossary
    41.92 Methodology
    Exploit maturity

    An exploit is code or a technique that specifically uses a concrete vulnerability to force unintended behaviour — such as executing code or escalating privileges. It is the tool that turns a theoretical flaw into a practical attack.

    Read in glossary
    no public PoC known
    XIEM Effective CVSS

    XIEM® is the tiered managed-security operating model from NEOSEC and a registered trademark of NEOSEC GmbH. It extends classic SIEM — the central collection, normalisation and correlation of security-relevant events — with endpoint forensics, network visibility and deception technology, and consolidates them into three building tiers: Sentry, Orchestrate and Command.

    Read in glossary
    7.8 Methodology
    CVSS v3

    CVSS is the globally established, open standard for assessing the technical severity of a vulnerability on a scale from 0 to 10. It describes how easily a flaw can be exploited and what damage it can cause — but not how likely its actual exploitation is. CVSS and the complementary EPSS deliberately answer different questions.

    Read in glossary
    7.8
    EPSS score

    The EPSS score is the absolute model output for an individual vulnerability: the estimated probability of real-world exploitation within the next 30 days, expressed as a value between 0 and 1 (i.e. 0 % to 100 %). A score of 0.42 means „the model estimates a 42 % chance of real-world exploitation within 30 days“.

    Read in glossary
    0.2 %
    Low — model estimates < 1% exploitation likelihood.
    EPSS percentile

    The EPSS percentile is the relative position of a vulnerability within all EPSS-scored CVEs, expressed as a value between 0 and 1. A percentile of 0.90 means „this CVE has a higher EPSS score than 90 % of all other scored CVEs“. Unlike the EPSS score, it is not a probability — but a positioning within a ranking.

    Read in glossary
    11.2
    Elevated — this CVE ranks above at least 10% of all CVEs scored today.
    KEV status

    The KEV catalogue is a list maintained by the US authority CISA of vulnerabilities for which active exploitation in the wild has been confirmed. It answers not the question „how severe?“ but „is it already being attacked?“ — thereby sharply prioritising patching.

    Read in glossary
    —
    Published
    CISA assessment (SSVC)
    Exploitation: none known · not automatable · Technical impact: total
    Source: CISA Vulnrichment, as of 14 April 2025
    CWE

    CWE is a catalogue of typical weakness types in software and hardware — such as flawed input validation, unsafe memory handling or poor authentication. Where a CVE names a concrete vulnerability in a concrete product, a CWE describes the underlying class of defect.

    Read in glossary
    CWE-428

    Detection rules

    No NEOSEC detection rule is available for this vulnerability yet.

    Classification under NIS2 and CRA

    Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.

    NIS2

    NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management.

    Read in glossary
    High technical severity: assess and remediate the vulnerability in vulnerability handling under Art. 21(2)(e) NIS2 and document the decision.
    CRA

    The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates.

    Read in glossary
    From 11.12.2027, Annex I Part II CRA requires manufacturers of affected products with digital elements to handle vulnerabilities without delay and provide security updates.
    ISO/IEC 27001

    ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security.

    Read in glossary
    Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.

    Description

    Realtek Audio Drivers for Windows, as used on the Lenovo ThinkPad X1 Carbon 20A7, 20A8, 20BS, and 20BT before 6.0.8882.1 and 20KH and 20KG before 6.0.8907.1 (and on many other Lenovo and non-Lenovo products), mishandles DLL preloading.

    Source: NVD (NIST), cvelistv5

    Vendors and products

    Affected operating systems

    Affected operating systems
    Otherlenovoaio300-23isu_firmware—
    Otherlenovoaio310-20iap_firmware—
    Otherlenovoaio510-22ish_firmware—
    Otherlenovoaio510-23ish_firmware—
    Otherlenovoaio520-22ikl_firmware—
    Otherlenovoaio520-22iku_firmware—
    Otherlenovoaio520-24ikl_firmware—
    Otherlenovoaio520-24iku_firmware—
    Otherlenovoaio520-27ikl_firmware—
    Otherlenovoaio720-24ikb_firmware—
    Otherlenovoaio_910-27ish_firmware—
    Otherlenovoaio_y910-27ish_firmware—
    Otherlenovoideacentre_300s-11ish_firmware—
    Otherlenovoideacentre_310-15asr_firmware—
    Otherlenovoideacentre_310-15iap_firmware—
    Otherlenovoideacentre_310a-15iap_firmware—
    Otherlenovoideacentre_310s-08iap_firmware—
    Otherlenovoideacentre_510-15abr_firmware—
    Otherlenovoideacentre_510-15ikl_firmware—
    Otherlenovoideacentre_510s-08ikl_firmware—
    Otherlenovoideacentre_510s-08ish_firmware—
    Otherlenovoideacentre_520s-23iku_firmware—
    Otherlenovoideacentre_610s-02ish_firmware—
    Otherlenovoideacentre_620s-03ikl_firmware—

    Weakness classes (CWE)

    • CWE-428Unquoted Search Path or Element

      Base

      The product uses a search path that contains an unquoted element, in which the element contains whitespace or other separators. This can cause the product to access resources in a parent path.

      Entry at MITRE CWE-428

    References & sources

    • support.lenovo.comus/en/product_security/ps500315-realtek-audio-driver-vulnerabil…Vendor advisory
    Embed badge

    Show the severity and KEV status of this vulnerability on your site – with a link back here. The image is updated hourly.

    Badge preview for CVE-2019-19705
    <a href="https://intel.neosec.eu/en/cve/CVE-2019-19705"><img src="https://intel.neosec.eu/badge/cve/CVE-2019-19705.svg?lang=en" alt="CVE-2019-19705 – NEOSEC Intel" height="20"></a>