Lenovo implemented Intel CSME Anti-rollback ARB protections on some ThinkPad models to…
Priority LOW 30Published · Updated
Key facts
- Attack vector
- Physical
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA.
Summary
Lenovo implemented Intel CSME Anti-rollback ARB protections on some ThinkPad models to prevent roll back of CSME Firmware in flash.
Why it matters now
EPSS 0.00297 22nd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Lenovo | BIOS | various | — | No fix listed | CNA |
- BIOS VendorLenovo Affected various Fixed in — No fix listed CNA
CPE configurations NVD · 76
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:lenovo:thinkpad_e14_firmware:*:*:*:*:*:*:*:* | before 2020-07-10 | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:thinkpad_e14:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:o:lenovo:thinkpad_e15_firmware:*:*:*:*:*:*:*:* | before 2020-07-10 | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:thinkpad_e15:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:o:lenovo:thinkpad_r14_firmware:*:*:*:*:*:*:*:* | before 2020-07-10 | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:thinkpad_r14:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:o:lenovo:thinkpad_s3_gen_2_firmware:*:*:*:*:*:*:*:* | before 2020-07-10 | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:thinkpad_s3_gen_2:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:o:lenovo:thinkpad_e490s_firmware:*:*:*:*:*:*:*:* | before 2020-07-10 | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:thinkpad_e490s:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
- cpe:2.3:o:lenovo:thinkpad_e14_firmware:*:*:*:*:*:*:*:* Versions before 2020-07-10 Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:thinkpad_e14:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:o:lenovo:thinkpad_e15_firmware:*:*:*:*:*:*:*:* Versions before 2020-07-10 Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:thinkpad_e15:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:o:lenovo:thinkpad_r14_firmware:*:*:*:*:*:*:*:* Versions before 2020-07-10 Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:thinkpad_r14:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:o:lenovo:thinkpad_s3_gen_2_firmware:*:*:*:*:*:*:*:* Versions before 2020-07-10 Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:thinkpad_s3_gen_2:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:o:lenovo:thinkpad_e490s_firmware:*:*:*:*:*:*:*:* Versions before 2020-07-10 Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:thinkpad_e490s:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
Show 66 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:lenovo:thinkpad_s3_firmware:*:*:*:*:*:*:*:* | before 2020-07-10 | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:thinkpad_s3:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:o:lenovo:thinkpad_e490_firmware:*:*:*:*:*:*:*:* | before 2020-07-10 | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:thinkpad_e490:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:o:lenovo:thinkpad_e590_firmware:*:*:*:*:*:*:*:* | before 2020-07-10 | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:thinkpad_e590:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:o:lenovo:thinkpad_r490_firmware:*:*:*:*:*:*:*:* | before 2020-07-10 | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:thinkpad_r490:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:o:lenovo:thinkpad_r590_firmware:*:*:*:*:*:*:*:* | before 2020-07-10 | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:thinkpad_r590:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:o:lenovo:thinkpad_l13_1st_gen_firmware:*:*:*:*:*:*:*:* | before 2020-07-10 | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:thinkpad_l13_1st_gen:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:o:lenovo:thinkpad_l1415_gen_1_firmware:*:*:*:*:*:*:*:* | before 2020-07-10 | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:thinkpad_l1415_gen_1:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:o:lenovo:thinkpad_l390_yoga_firmware:*:*:*:*:*:*:*:* | before 2020-07-10 | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:thinkpad_l390_yoga:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:o:lenovo:thinkpad_s2_yoga_4th_gen_firmware:*:*:*:*:*:*:*:* | before 2020-07-10 | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:thinkpad_s2_yoga_4th_gen:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:o:lenovo:thinkpad_l490_firmware:*:*:*:*:*:*:*:* | before 2020-07-10 | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:thinkpad_l490:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:o:lenovo:thinkpad_l590_firmware:*:*:*:*:*:*:*:* | before 2020-07-10 | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:thinkpad_l590:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:o:lenovo:thinkpad_p1_\(20mx\)_firmware:*:*:*:*:*:*:*:* | before n2eet47w | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:thinkpad_p1_\(20mx\):-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:o:lenovo:thinkpad_p1_\(20qx\)_firmware:*:*:*:*:*:*:*:* | before n2oet44w | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:thinkpad_p1_\(20qx\):-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:o:lenovo:thinkpad_p43s_\(20rx\)_firmware:*:*:*:*:*:*:*:* | before n2iet88w | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:thinkpad_p43s_\(20rx\):-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:o:lenovo:thinkpad_p52_\(20mx\)_firmware:*:*:*:*:*:*:*:* | before n2cet51w-1.34 | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:thinkpad_p52_\(20mx\):-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:o:lenovo:thinkpad_p53_\(20qx\)_firmware:*:*:*:*:*:*:*:* | before n2net37w | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:thinkpad_p53_\(20qx\):-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:o:lenovo:thinkpad_p53s_\(20nx\)_firmware:*:*:*:*:*:*:*:* | before n2iet88w | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:thinkpad_p53s_\(20nx\):-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:o:lenovo:thinkpad_p72_\(20mx\)_firmware:*:*:*:*:*:*:*:* | before n2cet51w | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:thinkpad_p72_\(20mx\):-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:o:lenovo:thinkpad_p73_\(20qx\)_firmware:*:*:*:*:*:*:*:* | before n2net37w | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:thinkpad_p73_\(20qx\):-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:o:lenovo:thinkpad_t490_\(20nx\)_firmware:*:*:*:*:*:*:*:* | before n2iet88w | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:thinkpad_t490_\(20nx\):-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:o:lenovo:thinkpad_t490_\(20qx\)_firmware:*:*:*:*:*:*:*:* | before n2iet88w | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:thinkpad_t490_\(20qx\):-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:o:lenovo:thinkpad_t490_\(20rx\)_firmware:*:*:*:*:*:*:*:* | before n2iet88w | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:thinkpad_t490_\(20rx\):-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:o:lenovo:thinkpad_t490s_\(20nx\)_firmware:*:*:*:*:*:*:*:* | before n2jet87w | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:thinkpad_t490s_\(20nx\):-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:o:lenovo:thinkpad_t590_\(20nx\)_firmware:*:*:*:*:*:*:*:* | before n2iet88w | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:thinkpad_t590_\(20nx\):-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:o:lenovo:thinkpad_x1_carbon_\(20qx\)_firmware:*:*:*:*:*:*:*:* | before n2het47w | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:thinkpad_x1_carbon_\(20qx\):-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:o:lenovo:thinkpad_x1_carbon_\(20rx\)_firmware:*:*:*:*:*:*:*:* | before n2het47w | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:thinkpad_x1_carbon_\(20rx\):-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:o:lenovo:thinkpad_x1_extreme_\(20mx\)_firmware:*:*:*:*:*:*:*:* | before n2eet47w | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:thinkpad_x1_extreme_\(20mx\):-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:o:lenovo:thinkpad_x1_extreme_\(20qx\)_firmware:*:*:*:*:*:*:*:* | before n2oet44w | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:thinkpad_x1_extreme_\(20qx\):-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:o:lenovo:thinkpad_x1_yoga_\(20qx\)_firmware:*:*:*:*:*:*:*:* | before n2het47w | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:thinkpad_x1_yoga_\(20qx\):-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:o:lenovo:thinkpad_x1_yoga_\(20sx\)_firmware:*:*:*:*:*:*:*:* | before n2het47w | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:thinkpad_x1_yoga_\(20sx\):-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:o:lenovo:thinkpad_x390_\(20qx\)_firmware:*:*:*:*:*:*:*:* | before n2jet87w | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:thinkpad_x390_\(20qx\):-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:o:lenovo:thinkpad_x390_\(20sx\)_firmware:*:*:*:*:*:*:*:* | before n2set18w | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:thinkpad_x390_\(20sx\):-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:o:lenovo:thinkpad_x390_yoga_firmware:*:*:*:*:*:*:*:* | before n2let74w | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:thinkpad_x390_yoga:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
- cpe:2.3:o:lenovo:thinkpad_s3_firmware:*:*:*:*:*:*:*:* Versions before 2020-07-10 Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:thinkpad_s3:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:o:lenovo:thinkpad_e490_firmware:*:*:*:*:*:*:*:* Versions before 2020-07-10 Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:thinkpad_e490:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:o:lenovo:thinkpad_e590_firmware:*:*:*:*:*:*:*:* Versions before 2020-07-10 Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:thinkpad_e590:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:o:lenovo:thinkpad_r490_firmware:*:*:*:*:*:*:*:* Versions before 2020-07-10 Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:thinkpad_r490:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:o:lenovo:thinkpad_r590_firmware:*:*:*:*:*:*:*:* Versions before 2020-07-10 Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:thinkpad_r590:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:o:lenovo:thinkpad_l13_1st_gen_firmware:*:*:*:*:*:*:*:* Versions before 2020-07-10 Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:thinkpad_l13_1st_gen:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:o:lenovo:thinkpad_l1415_gen_1_firmware:*:*:*:*:*:*:*:* Versions before 2020-07-10 Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:thinkpad_l1415_gen_1:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:o:lenovo:thinkpad_l390_yoga_firmware:*:*:*:*:*:*:*:* Versions before 2020-07-10 Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:thinkpad_l390_yoga:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:o:lenovo:thinkpad_s2_yoga_4th_gen_firmware:*:*:*:*:*:*:*:* Versions before 2020-07-10 Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:thinkpad_s2_yoga_4th_gen:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:o:lenovo:thinkpad_l490_firmware:*:*:*:*:*:*:*:* Versions before 2020-07-10 Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:thinkpad_l490:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:o:lenovo:thinkpad_l590_firmware:*:*:*:*:*:*:*:* Versions before 2020-07-10 Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:thinkpad_l590:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:o:lenovo:thinkpad_p1_\(20mx\)_firmware:*:*:*:*:*:*:*:* Versions before n2eet47w Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:thinkpad_p1_\(20mx\):-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:o:lenovo:thinkpad_p1_\(20qx\)_firmware:*:*:*:*:*:*:*:* Versions before n2oet44w Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:thinkpad_p1_\(20qx\):-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:o:lenovo:thinkpad_p43s_\(20rx\)_firmware:*:*:*:*:*:*:*:* Versions before n2iet88w Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:thinkpad_p43s_\(20rx\):-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:o:lenovo:thinkpad_p52_\(20mx\)_firmware:*:*:*:*:*:*:*:* Versions before n2cet51w-1.34 Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:thinkpad_p52_\(20mx\):-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:o:lenovo:thinkpad_p53_\(20qx\)_firmware:*:*:*:*:*:*:*:* Versions before n2net37w Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:thinkpad_p53_\(20qx\):-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:o:lenovo:thinkpad_p53s_\(20nx\)_firmware:*:*:*:*:*:*:*:* Versions before n2iet88w Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:thinkpad_p53s_\(20nx\):-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:o:lenovo:thinkpad_p72_\(20mx\)_firmware:*:*:*:*:*:*:*:* Versions before n2cet51w Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:thinkpad_p72_\(20mx\):-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:o:lenovo:thinkpad_p73_\(20qx\)_firmware:*:*:*:*:*:*:*:* Versions before n2net37w Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:thinkpad_p73_\(20qx\):-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:o:lenovo:thinkpad_t490_\(20nx\)_firmware:*:*:*:*:*:*:*:* Versions before n2iet88w Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:thinkpad_t490_\(20nx\):-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:o:lenovo:thinkpad_t490_\(20qx\)_firmware:*:*:*:*:*:*:*:* Versions before n2iet88w Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:thinkpad_t490_\(20qx\):-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:o:lenovo:thinkpad_t490_\(20rx\)_firmware:*:*:*:*:*:*:*:* Versions before n2iet88w Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:thinkpad_t490_\(20rx\):-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:o:lenovo:thinkpad_t490s_\(20nx\)_firmware:*:*:*:*:*:*:*:* Versions before n2jet87w Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:thinkpad_t490s_\(20nx\):-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:o:lenovo:thinkpad_t590_\(20nx\)_firmware:*:*:*:*:*:*:*:* Versions before n2iet88w Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:thinkpad_t590_\(20nx\):-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:o:lenovo:thinkpad_x1_carbon_\(20qx\)_firmware:*:*:*:*:*:*:*:* Versions before n2het47w Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:thinkpad_x1_carbon_\(20qx\):-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:o:lenovo:thinkpad_x1_carbon_\(20rx\)_firmware:*:*:*:*:*:*:*:* Versions before n2het47w Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:thinkpad_x1_carbon_\(20rx\):-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:o:lenovo:thinkpad_x1_extreme_\(20mx\)_firmware:*:*:*:*:*:*:*:* Versions before n2eet47w Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:thinkpad_x1_extreme_\(20mx\):-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:o:lenovo:thinkpad_x1_extreme_\(20qx\)_firmware:*:*:*:*:*:*:*:* Versions before n2oet44w Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:thinkpad_x1_extreme_\(20qx\):-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:o:lenovo:thinkpad_x1_yoga_\(20qx\)_firmware:*:*:*:*:*:*:*:* Versions before n2het47w Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:thinkpad_x1_yoga_\(20qx\):-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:o:lenovo:thinkpad_x1_yoga_\(20sx\)_firmware:*:*:*:*:*:*:*:* Versions before n2het47w Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:thinkpad_x1_yoga_\(20sx\):-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:o:lenovo:thinkpad_x390_\(20qx\)_firmware:*:*:*:*:*:*:*:* Versions before n2jet87w Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:thinkpad_x390_\(20qx\):-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:o:lenovo:thinkpad_x390_\(20sx\)_firmware:*:*:*:*:*:*:*:* Versions before n2set18w Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:thinkpad_x390_\(20sx\):-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:o:lenovo:thinkpad_x390_yoga_firmware:*:*:*:*:*:*:*:* Versions before n2let74w Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:thinkpad_x390_yoga:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2020-8336
- 2026-10-03 Alias added: GHSA-rmxg-p4v2-9f92
References
More Lenovo Thinkpad E14 Firmware vulnerabilities
- TI-2023-02148 Out-of-bounds write in Lenovo ThinkPad CVSS 3.1MEDIUM 6.7
- TI-2022-23843 Improper input validation in Lenovo ThinkPad BIOS CVSS 3.1MEDIUM 6.7
- TI-2020-06726 A potential vulnerability in the SMI callback function used in the Legacy SD driver in… CVSS 3.1MEDIUM 6.7
- TI-2020-06723 An internal shell was included in BIOS image in some ThinkPad models that could allow escalation of privilege. CVSS 3.1MEDIUM 6.8
- TI-2021-02546 Improper input validation in Lenovo ThinkPad BIOS CVSS 3.1MEDIUM 6.7
- TI-2021-02717 Improper input validation in Lenovo Notebook and ThinkPad BIOS CVSS 3.1MEDIUM 5.5
Sources
- CVE-2020-8336 · CVE Program
- CVE-2020-8336 · NVD
- FIRST EPSS
- GHSA-rmxg-p4v2-9f92 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences