In Lenovo systems, SMM BIOS Write Protection is used to prevent writes to SPI Flash.
Priority LOW 12Published · Updated
Key facts
- Attack vector
- Physical
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · Low · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA.
Summary
In Lenovo systems, SMM BIOS Write Protection is used to prevent writes to SPI Flash. While this provides sufficient protection, an additional layer of protection is provided by SPI Protected Range Registers (PRx). After resuming from S3 sleep mode in various versions of BIOS for some Lenovo ThinkPad systems, the PRx is not set. This does not impact the SMM BIOS Write Protection, which keeps systems protected.
Why it matters now
EPSS 0.00347 28th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Lenovo | ThinkPad | various | — | No fix listed | CNA |
- ThinkPad VendorLenovo Affected various Fixed in — No fix listed CNA
CPE configurations NVD · 20
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:lenovo:thinkpad_t490_\(20nx\)_firmware:*:*:*:*:*:*:*:* | before n2iet90w | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:thinkpad_t490_\(20nx\):-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:o:lenovo:thinkpad_t490_\(20qx\)_firmware:*:*:*:*:*:*:*:* | before n2iet90w | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:thinkpad_t490_\(20qx\):-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:o:lenovo:thinkpad_t490_\(20rx\)_firmware:*:*:*:*:*:*:*:* | before n2ret16w | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:thinkpad_t490_\(20rx\):-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:o:lenovo:thinkpad_t490s_\(20nx\)_firmware:*:*:*:*:*:*:*:* | before n2jet89w | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:thinkpad_t490s_\(20nx\):-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:o:lenovo:thinkpad_t495_drift_firmware:*:*:*:*:*:*:*:* | before 2020-08-30 | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:thinkpad_t495_drift:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
- cpe:2.3:o:lenovo:thinkpad_t490_\(20nx\)_firmware:*:*:*:*:*:*:*:* Versions before n2iet90w Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:thinkpad_t490_\(20nx\):-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:o:lenovo:thinkpad_t490_\(20qx\)_firmware:*:*:*:*:*:*:*:* Versions before n2iet90w Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:thinkpad_t490_\(20qx\):-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:o:lenovo:thinkpad_t490_\(20rx\)_firmware:*:*:*:*:*:*:*:* Versions before n2ret16w Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:thinkpad_t490_\(20rx\):-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:o:lenovo:thinkpad_t490s_\(20nx\)_firmware:*:*:*:*:*:*:*:* Versions before n2jet89w Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:thinkpad_t490s_\(20nx\):-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:o:lenovo:thinkpad_t495_drift_firmware:*:*:*:*:*:*:*:* Versions before 2020-08-30 Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:thinkpad_t495_drift:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
Show 10 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:lenovo:thinkpad_t590_\(20nx\)_firmware:*:*:*:*:*:*:*:* | before n2iet90w | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:thinkpad_t590_\(20nx\):-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:o:lenovo:thinkpad_x1_carbon_\(20qx\)_firmware:*:*:*:*:*:*:*:* | before n2het54w | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:thinkpad_x1_carbon_\(20qx\):-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:o:lenovo:thinkpad_x1_yoga_\(20qx\)_firmware:*:*:*:*:*:*:*:* | before n2het54w | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:thinkpad_x1_yoga_\(20qx\):-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:o:lenovo:thinkpad_x390_\(20qx\)_firmware:*:*:*:*:*:*:*:* | before n2jet89w | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:thinkpad_x390_\(20qx\):-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:o:lenovo:thinkpad_x390_\(20sx\)_firmware:*:*:*:*:*:*:*:* | before n2set18w | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:thinkpad_x390_\(20sx\):-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
- cpe:2.3:o:lenovo:thinkpad_t590_\(20nx\)_firmware:*:*:*:*:*:*:*:* Versions before n2iet90w Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:thinkpad_t590_\(20nx\):-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:o:lenovo:thinkpad_x1_carbon_\(20qx\)_firmware:*:*:*:*:*:*:*:* Versions before n2het54w Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:thinkpad_x1_carbon_\(20qx\):-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:o:lenovo:thinkpad_x1_yoga_\(20qx\)_firmware:*:*:*:*:*:*:*:* Versions before n2het54w Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:thinkpad_x1_yoga_\(20qx\):-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:o:lenovo:thinkpad_x390_\(20qx\)_firmware:*:*:*:*:*:*:*:* Versions before n2jet89w Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:thinkpad_x390_\(20qx\):-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:o:lenovo:thinkpad_x390_\(20sx\)_firmware:*:*:*:*:*:*:*:* Versions before n2set18w Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:thinkpad_x390_\(20sx\):-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2020-8341
- 2026-10-03 Alias added: GHSA-f46h-7c54-hvw7
References
More Lenovo Thinkpad T490 (20nx) Firmware vulnerabilities
- TI-2020-06736 Lenovo implemented Intel CSME Anti-rollback ARB protections on some ThinkPad models to… CVSS 3.1MEDIUM 6.8
Sources
- CVE-2020-8341 · CVE Program
- CVE-2020-8341 · NVD
- FIRST EPSS
- GHSA-f46h-7c54-hvw7 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences