Read the docs
TI-2020-06735 Aliases CVE-2020-8335GHSA-fvh7-v69p-hj2v

The BIOS tamper detection mechanism was not triggered in Lenovo ThinkPad A285, BIOS…

Priority LOW 30Published · Updated

Key facts

Attack vector
Physical
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

The BIOS tamper detection mechanism was not triggered in Lenovo ThinkPad A285, BIOS versions up to r0xuj70w; A485, BIOS versions up to r0wuj65w; T495 BIOS versions up to r12uj55w; T495s/X395, BIOS versions up to r13uj47w, while the emergency-reset button is pressed which may allow for unauthorized access.

Why it matters now

EPSS 0.00313 24th percentileScored 2026-11-07
Fix Fixed ThinkPad A285 BIOS (Lenovo): r0xuj70wThinkPad A485 BIOS (Lenovo): r0wuj65w+2 more products

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
LenovoThinkPad A285 BIOSbefore r0xuj70wr0xuj70wPatch availableCNA
LenovoThinkPad A485 BIOSbefore r0wuj65wr0wuj65wPatch availableCNA
LenovoThinkPad T495 BIOSbefore r12uj55wr12uj55wPatch availableCNA
LenovoThinkPad T495s/X395 BIOSbefore r13uj47wr13uj47wPatch availableCNA
  • ThinkPad A285 BIOS VendorLenovo Affected before r0xuj70w Fixed in r0xuj70w Patch available CNA
  • ThinkPad A485 BIOS VendorLenovo Affected before r0wuj65w Fixed in r0wuj65w Patch available CNA
  • ThinkPad T495 BIOS VendorLenovo Affected before r12uj55w Fixed in r12uj55w Patch available CNA
  • ThinkPad T495s/X395 BIOS VendorLenovo Affected before r13uj47w Fixed in r13uj47w Patch available CNA

CPE configurations NVD · 16

CPEVersionsRoleVendor
cpe:2.3:o:lenovo:thinkpad_a275_firmware:*:*:*:*:*:*:*:*before 2020-08-30VulnerableLenovo
cpe:2.3:h:lenovo:thinkpad_a275:-:*:*:*:*:*:*:*not specified by NVDRunning onLenovo
cpe:2.3:o:lenovo:thinkpad_a285_firmware:*:*:*:*:*:*:*:*before 2020-08-30VulnerableLenovo
cpe:2.3:h:lenovo:thinkpad_a285:-:*:*:*:*:*:*:*not specified by NVDRunning onLenovo
cpe:2.3:o:lenovo:thinkpad_a475_firmware:*:*:*:*:*:*:*:*before 2020-08-30VulnerableLenovo
cpe:2.3:h:lenovo:thinkpad_a475:-:*:*:*:*:*:*:*not specified by NVDRunning onLenovo
cpe:2.3:o:lenovo:thinkpad_a485_firmware:*:*:*:*:*:*:*:*before 2020-08-30VulnerableLenovo
cpe:2.3:h:lenovo:thinkpad_a485:-:*:*:*:*:*:*:*not specified by NVDRunning onLenovo
cpe:2.3:o:lenovo:thinkpad_t495_drift_firmware:*:*:*:*:*:*:*:*before 2020-08-30VulnerableLenovo
cpe:2.3:h:lenovo:thinkpad_t495_drift:-:*:*:*:*:*:*:*not specified by NVDRunning onLenovo
  • cpe:2.3:o:lenovo:thinkpad_a275_firmware:*:*:*:*:*:*:*:* Versions before 2020-08-30 Vulnerable ·Lenovo
  • cpe:2.3:h:lenovo:thinkpad_a275:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
  • cpe:2.3:o:lenovo:thinkpad_a285_firmware:*:*:*:*:*:*:*:* Versions before 2020-08-30 Vulnerable ·Lenovo
  • cpe:2.3:h:lenovo:thinkpad_a285:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
  • cpe:2.3:o:lenovo:thinkpad_a475_firmware:*:*:*:*:*:*:*:* Versions before 2020-08-30 Vulnerable ·Lenovo
  • cpe:2.3:h:lenovo:thinkpad_a475:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
  • cpe:2.3:o:lenovo:thinkpad_a485_firmware:*:*:*:*:*:*:*:* Versions before 2020-08-30 Vulnerable ·Lenovo
  • cpe:2.3:h:lenovo:thinkpad_a485:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
  • cpe:2.3:o:lenovo:thinkpad_t495_drift_firmware:*:*:*:*:*:*:*:* Versions before 2020-08-30 Vulnerable ·Lenovo
  • cpe:2.3:h:lenovo:thinkpad_t495_drift:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
Show 6 more CPE
CPEVersionsRoleVendor
cpe:2.3:o:lenovo:thinkpad_t495s_jazz_firmware:*:*:*:*:*:*:*:*before 2020-08-30VulnerableLenovo
cpe:2.3:h:lenovo:thinkpad_t495s_jazz:-:*:*:*:*:*:*:*not specified by NVDRunning onLenovo
cpe:2.3:o:lenovo:thinkpad_x1_carbon_\(20bx\)_firmware:*:*:*:*:*:*:*:*before n14et54wVulnerableLenovo
cpe:2.3:h:lenovo:thinkpad_x1_carbon_\(20bx\):-:*:*:*:*:*:*:*not specified by NVDRunning onLenovo
cpe:2.3:o:lenovo:thinkpad_x395_firmware:*:*:*:*:*:*:*:*before 2020-08-30VulnerableLenovo
cpe:2.3:h:lenovo:thinkpad_x395:-:*:*:*:*:*:*:*not specified by NVDRunning onLenovo
  • cpe:2.3:o:lenovo:thinkpad_t495s_jazz_firmware:*:*:*:*:*:*:*:* Versions before 2020-08-30 Vulnerable ·Lenovo
  • cpe:2.3:h:lenovo:thinkpad_t495s_jazz:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
  • cpe:2.3:o:lenovo:thinkpad_x1_carbon_\(20bx\)_firmware:*:*:*:*:*:*:*:* Versions before n14et54w Vulnerable ·Lenovo
  • cpe:2.3:h:lenovo:thinkpad_x1_carbon_\(20bx\):-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
  • cpe:2.3:o:lenovo:thinkpad_x395_firmware:*:*:*:*:*:*:*:* Versions before 2020-08-30 Vulnerable ·Lenovo
  • cpe:2.3:h:lenovo:thinkpad_x395:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo

Remediation

  • Fix · CNA ThinkPad A285 BIOS (Lenovo) Fixed in r0xuj70w
  • Fix · CNA ThinkPad A485 BIOS (Lenovo) Fixed in r0wuj65w
  • Fix · CNA ThinkPad T495 BIOS (Lenovo) Fixed in r12uj55w
  • Fix · CNA ThinkPad T495s/X395 BIOS (Lenovo) Fixed in r13uj47w

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-8335
  2. 2026-10-03 Alias added: GHSA-fvh7-v69p-hj2v

References

Advisory 1

  • TI-2019-14200 Realtek Audio Drivers for Windows, as used on the Lenovo ThinkPad X1 Carbon 20A7, 20A8… CVSS 3.1HIGH 7.8
  • TI-2019-13465 Incorrect parameter validation in the synaTee component of Synaptics WBF drivers using an… CVSS 3.1HIGH 7.8
  • TI-2019-08001 There is a vulnerability with the Dolby DAX2 API system services in which a… CVSS 3.0MEDIUM 6.5
  • TI-2020-06734 Improper check for unusual conditions in Lenovo BIOS CVSS 3.1MEDIUM 6.8
  • TI-2020-06726 A potential vulnerability in the SMI callback function used in the Legacy SD driver in… CVSS 3.1MEDIUM 6.7
  • TI-2020-06723 An internal shell was included in BIOS image in some ThinkPad models that could allow escalation of privilege. CVSS 3.1MEDIUM 6.8
See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences