Revision : 02 -------------------------------------------------------------------------------- Software name Intel Management Engine 10.0 Firmware Support models [Windows 10 64-bit support] ThinkPad Helix 2nd Gen (Machine types: 20CG, 20CH) ThinkPad T550 ThinkPad W550s ThinkPad X1 Carbon (Machine types: 20BS, 20BT) ThinkPad X250 [Windows 8.1 64-bit support] ThinkPad Helix 2nd Gen (Machine types: 20CG, 20CH) ThinkPad T550 ThinkPad W550s ThinkPad X1 Carbon (Machine types: 20BS, 20BT) ThinkPad X250 [Windows 7 32-bit, 64-bit support] ThinkPad T550 ThinkPad W550s ThinkPad X1 Carbon (Machine types: 20BS, 20BT) ThinkPad X250 Operating Systems Microsoft Windows 10 64-bit Microsoft Windows 8.1 64-bit Microsoft Windows 7 32-bit, 64-bit Refer to marketing materials to find out what computer models support which Operating Systems. Version 10.0.60.3000 -------------------------------------------------------------------------------- WHAT THIS PACKAGE DOES This package updates the following software. - Intel Management Engine Firmware Refer to marketing materials to find out what computer models support Intel Management Engine. Updating the software will fix problems, add new functions, or expand functions as noted below. This program is language dependent, but can be used with any language system. -------------------------------------------------------------------------------- CHANGES IN THIS RELEASE Version 10.0.60.3000 [Important updates] - Address security vulnerability issues CVE-2019-6173 and CVE-2019-6196. [New functions or enhancements] Nothing. [Problem fixes] Nothing. -------------------------------------------------------------------------------- DETERMINING WHICH VERSION IS INSTALLED 1. Open the Command Prompt as administrator. [Windows 10/8.1] 1. Hold down the Windows logo key and press X to open a menu at the lower-left area of the screen. 2. Select Command Prompt (Admin) from the menu, and select Yes. [Windows 7] 1. Open the Start menu, type cmd in the search box and press Ctrl+Shift+Enter. 2. In the Command Prompt, type the following command and press Enter. [Path where the files were extracted]\MEInfoWin.exe Example: C:\DRIVERS\WIN\ME\MEInfoWin.exe The following information will be displayed. Example: Intel(R) MEInfo Version: 10.0.xx.xxxx Copyright(C) 2005 - 201x, Intel Corporation. All rights reserved. Intel(R) Manageability and Security Application code versions: BIOS Version: N1xETxxW (x.xx ) MEBx Version: 10.0.x.xxxx Gbe Version: x.x VendorID: 8086 PCH Version: x ==> FW Version: 10.0.60.3000 LP <== LMS Version: 10.0.xx.xxxx MEI Driver Version: 10.0.xx.xxxx 3. Check the FW Version. If you see any errors, check the Device Manager to see if the following device exists and is working properly. Under System devices category, Intel(R) Management Engine Interface If it does not exist, install the following software: Intel Management Engine 11.7 Software -------------------------------------------------------------------------------- NOTES Nothing. -------------------------------------------------------------------------------- UPDATE INSTRUCTIONS Important: *for systems with MEFW version older than 10.0.55.3000. - Before updating to this firmware, if you are using Intel Active Management Technology, Intel Small Business Technology, or Intel Standard Manageability, you should first unprovision your system by downloading and following the instructions available on the link below: https://downloadcenter.intel.com/search?keyword=unprovisioning%20tool *If these technologies are not configured on your system, you can disregard above information. *After unprovision and MEFW update, you can then re-provision your system. Note: - If your computer runs satisfactorily now, it may not be necessary to update the software. To determine if you should update the software, refer to the Version Information section. - Confirm first with your IT administrator if updating the Management Engine firmware is necessary. - Prior to the firmware update, connect the AC adapter and fully charged battery (if applicable) to the system. - Downgrading the Management Engine firmware to an older version is not allowed. - Make sure the following device is installed in the Device Manager. In the System devices category, Intel(R) Management Engine Interface If not exists, install the following software: Intel Management Engine 11.7 Software Manual Update This section assumes to use Microsoft Edge and Windows Explorer. Downloading files 1. Click once on the underlined file name. Once this is done, some pop-up windows will appear. 2. Follow the instructions on the screen. 3. In the window to choose "Save" or "Save as", click "Save". Once the download has completed, there may or may not be a message stating that the download completed successfully. Extracting files 4. Make sure to be logged on with an administrator account on the target computer. 5. Make sure the AC adapter is firmly connected to the target computer. 6. Open a Windows Explorer and select "Downloads" from "Quick access". 7. Locate the file that was downloaded and double-click it. 8. Follow the instructions on the screen. 9. In Extract or Install? window, select "Install", click Next, and move to step 13 to continue installation. Or, select "Extract only" and click Next to extract and keep the files on the specified folder. *Make sure there are no spaces on the directory path to where the ME Firmware Update package is to be extracted. 10. In the Select Destination Location window, click Extract. If you would like to select a different folder, click Browse. 11. All the necessary files will be extracted to the folder selected in the step 10. 12. Click Finish. Updating the ME Firmware 13. In the Ready to Install window, click Install. All the necessary files will be extracted to a temporary folder. And extracted files will be deleted after installation. 14. Click Finish. 15. In the Intel Management Engine FW Update Utility window, click Next to proceed. 16. Read all the requirements and warnings, then click Next. 17. When the message "Do you want to continue?" is displayed, click Yes to proceed with the ME firmware update. 18. When completed, a system reboot will be initiated to complete the firmware update. Unattended Install This is for system administrator's use only. 1. Refer to the Manual Install section, and download and extract the file. 2. Open Command Line with Administrator rights. 3. Navigate to the path where the files were extracted on Step 10 of "Extracting files" section and execute MEUpdate.CMD. Example: [Path where the files were extracted]\MEUpdate.CMD -------------------------------------------------------------------------------- VERSION INFORMATION The following versions have been released to date. Version Build ID Rev. Issue Date ------------- -------- ---- ---------- 10.0.60.3000 N10RG50W 02 2020/04/24 10.0.60.3000 N10RG50W 01 2018/07/27 10.0.57.3000 N10RG49W 01 2018/04/20 10.0.56.3002 N10RG48W 02 2017/12/15 10.0.56.3002 N10RG48W 01 2017/11/13 10.0.55.3000 N10RG47W 01 2017/05/18 10.0.50.1004 N10RG46W 01 2016/04/13 10.0.47.1006 N10RG45W 01 2015/12/11 10.0.46.1002 N10RG44W 01 2015/08/31 10.0.45.1024 N10RG43W 01 2015/07/29 10.0.38.1000 N10RG27W 02 2015/05/29 10.0.38.1000 N10RG27W 01 2015/03/13 10.0.30.1072 N10RG26W 02 2015/01/13 10.0.30.1072 N10RG26W 01 2014/12/10 10.0.29.1000 N10RG23W 01 2014/10/28 Note: Revision number (Rev.) is for administrative purpose of this README document and is not related to software version. There is no need to upgrade this software when the revision number changes. To check the version of software, refer to the Determining which version is installed section. Summary of Changes Where: < > Version number [Important] Important update (New) New function or enhancement (Fix) Correction to existing function <10.0.60.3000> (N10RG50W) -[Important] Address security vulnerability issues CVE-2019-6173 and CVE-2019-6196. <10.0.60.3000> (N10RG50W) -(Fix) Fixed security vulnerability: CVE-2018-3616. <10.0.57.3000> (N10RG49W) -(Fix) Fixed the following security vulnerabilities: CVE-2018-3628, CVE-2018-3629 and CVE-2018-3632. <10.0.56.3002> (N10RG48W) -(Fix) Fixed the following security vulnerabilities: CVE-2017-5711 and CVE-2017-5712 <10.0.56.3002> (N10RG48W) -(Fix) Fixed the following security vulnerabilities: CVE-2017-13077, CVE-2017-13078 and CVE-2017-13080 <10.0.55.3000> (N10RG47W) -(Fix) Fixed CVE-2017-5689: Escalation of privilege vulnerability in Intel(R) Active Management Technology (AMT), Intel(R) Standard Manageability (ISM), and Intel(R) Small Business Technology. -(Fix) Fixed an issue where Intel(R) AMT features might not be accessible when using domain local group. -(Fix) Fixed a security issue where Intel(R) AMT may crash during Kerberos authentication flow when processing a malformed Kerberos token. -(Fix) Fixed a security issue where some NV data could still be read after the NV index has been deleted. <10.0.50.1004> (N10RG46W) -(New) Added SHA2 root certificate hashes to support Remote Configuration -(New) Replaced all existing default SHA1 hashes with SHA256 hashes (for the same root certificates) -(Fix) Fixed an issue where "Unspecified event" might be displayed instead of a general message regarding woken by alarm clock when a platform wakes via Intel AMT Alarm Clock. -(Fix) Fixed Intel AMT Web UI security issue -(Fix) Fixed an issue where the Host Name and Domain Name might be cleared instead of returning to factory defaults when performing Full Unprovision or Intel ME Unconfiguration after EOM. -(Fix) Fixed possible corrupted playback of PAVP 2.0 or 3.0 <10.0.47.1006> (N10RG45W) -(Fix) Fixed the following issues: - Intel PTT security vulnerability issue. - Intel PTT returns TPM_RC_NV_SPACE response code when trying to define an NV Index with data size less than 0x360 bytes in Windows 10. - Policy fails with RC_Expired message even though expiration value is legal. - TPM2_GetCapability returns moreData =0 (instead of 1) when requesting 0 persistent handles even though there are persistent handles present in PTT. - PlayReady 3 playback is corrupted when an external monitor is connected and HDCP is not enabled. - Decrypting a buffer that was encrypted from a buffer smaller than the key size, returns the decrypted/original buffer plus additional data from the end of the original buffer. <10.0.46.1002> (N10RG44W) -(Fix) Fixed the following issues: - A bug in the implementation of the PlayReady 3.0 license acquisition, causing some license acquisitions to fail, therefore preventing movie playback - Intel PTT remains enabled even though the shipping state has been set to disabled <10.0.45.1024> (N10RG43W) -(New) Added support for Microsoft Play Ready 3.0 for Microsoft Windows 10. -(Fix) Fixed the following issues: - Security vulnerability impacting the Intel Management Engine network stack. - AMT does not reconfigure its DHCPv6 IP address after a DAD failure. - The LAN device is not in Ultra Low Power mode after resuming from system hibernate with the LAN cable disconnected. - Unexpected shut down during sleep stress test with active AMT and wireless AMT. - Intel PTT: It is possible to load session context after it was flushed. - Intel PTT enters failure mode after TPM2_HMAC command when keys alg and hashAlg are null. - Intel PTT: RSA Sign operation takes longer than required. - RSA key-cache does not refill when empty. <10.0.38.1000>(N10RG27W) -(New) Added support for Microsoft Windows 10 64-bit. <10.0.38.1000>(N10RG27W) -[Important] Removed support for SSL 3.0. -(Fix) Fixed the following issues: - When running sleep stress tests, the system may shut down. - A global reset may occur when the system is restarted multiple times while WLAN is enabled. - In some cases, the TPM clock can be set to an older clock. <10.0.30.1072>(n10rg26w) -(New) Added support for ThinkPad T550,W550s,X250. <10.0.30.1072>(N10RG26W) -(New) Added support for ThinkPad X1 Carbon (Machine types: 20BS, 20BT). -(Fix) Fixed an issue where yellow bang was displayed on TPM in Windows Device Manager. -(Fix) Fixed an issue where the WLAN micro code was not updated during BIOS/ME firmware update. -(Fix) Fixed an issue where the Intel ME Power Gating flow was disabled when LAN driver is enabled in OS. <10.0.29.1000>(N10RG23W) -(New) Added support for ThinkPad Helix 2nd Gen (Machine types: 20CG, 20CH). -------------------------------------------------------------------------------- LIMITATIONS Nothing. -------------------------------------------------------------------------------- TRADEMARKS * Lenovo and ThinkPad are registered trademarks of Lenovo. * Intel is a registered trademark of Intel Corporation. * Microsoft, BitLocker, Internet Explorer and Windows are registered trademarks of Microsoft Corporation. Other company, product, and service names may be registered trademarks, trademarks or service marks of others.