Prior to August 10, 2020, some Lenovo Desktop and Workstation systems were shipped with…
Priority LOW 30CWE-16Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- High
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA.
Summary
Prior to August 10, 2020, some Lenovo Desktop and Workstation systems were shipped with the Embedded Host Based Configuration (EHBC) feature of Intel AMT enabled. This could allow an administrative user with local access to configure Intel AMT.
Why it matters now
EPSS 0.00554 46th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed Desktop and Workstation systems (Lenovo): various
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Lenovo | Desktop and Workstation systems | before various | various | Patch available | CNA |
- Desktop and Workstation systems VendorLenovo Affected before various Fixed in various Patch available CNA
CPE configurations NVD · 28
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:lenovo:thinkcentre_m80t_firmware:*:*:*:*:*:*:*:* | before 2020-08-10 | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:thinkcentre_m80t:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:o:lenovo:thinkcentre_m80s_firmware:*:*:*:*:*:*:*:* | before 2020-08-10 | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:thinkcentre_m80s:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:o:lenovo:thinkcentre_m90t_firmware:*:*:*:*:*:*:*:* | before 2020-08-10 | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:thinkcentre_m90t:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:o:lenovo:thinkcentre_m90s_firmware:*:*:*:*:*:*:*:* | before 2020-08-10 | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:thinkcentre_m90s:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:o:lenovo:thinkcentre_m910z_firmware:*:*:*:*:*:*:*:* | before 2020-08-10 | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:thinkcentre_m910z:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
- cpe:2.3:o:lenovo:thinkcentre_m80t_firmware:*:*:*:*:*:*:*:* Versions before 2020-08-10 Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:thinkcentre_m80t:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:o:lenovo:thinkcentre_m80s_firmware:*:*:*:*:*:*:*:* Versions before 2020-08-10 Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:thinkcentre_m80s:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:o:lenovo:thinkcentre_m90t_firmware:*:*:*:*:*:*:*:* Versions before 2020-08-10 Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:thinkcentre_m90t:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:o:lenovo:thinkcentre_m90s_firmware:*:*:*:*:*:*:*:* Versions before 2020-08-10 Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:thinkcentre_m90s:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:o:lenovo:thinkcentre_m910z_firmware:*:*:*:*:*:*:*:* Versions before 2020-08-10 Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:thinkcentre_m910z:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
Show 18 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:lenovo:thinkcentre_m920s_firmware:*:*:*:*:*:*:*:* | before 2020-08-10 | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:thinkcentre_m920s:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:o:lenovo:thinkcentre_m920t_firmware:*:*:*:*:*:*:*:* | before 2020-08-10 | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:thinkcentre_m920t:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:o:lenovo:thinkcentre_m920q_firmware:*:*:*:*:*:*:*:* | before 2020-08-10 | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:thinkcentre_m920q:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:o:lenovo:thinkcentre_m920z_firmware:*:*:*:*:*:*:*:* | before 2020-08-10 | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:thinkcentre_m920z:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:o:lenovo:thinkstation_p330t_firmware:*:*:*:*:*:*:*:* | before 2020-08-10 | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:thinkstation_p330t:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:o:lenovo:thinkstation_p330s_firmware:*:*:*:*:*:*:*:* | before 2020-08-10 | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:thinkstation_p330s:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:o:lenovo:thinkstation_p330_tiny_firmware:*:*:*:*:*:*:*:* | before 2020-08-10 | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:thinkstation_p330_tiny:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:o:lenovo:thinkstation_p340t_firmware:*:*:*:*:*:*:*:* | before 2020-08-10 | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:thinkstation_p340t:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:o:lenovo:thinkstation_p340s_firmware:*:*:*:*:*:*:*:* | before 2020-08-10 | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:thinkstation_p340s:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
- cpe:2.3:o:lenovo:thinkcentre_m920s_firmware:*:*:*:*:*:*:*:* Versions before 2020-08-10 Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:thinkcentre_m920s:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:o:lenovo:thinkcentre_m920t_firmware:*:*:*:*:*:*:*:* Versions before 2020-08-10 Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:thinkcentre_m920t:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:o:lenovo:thinkcentre_m920q_firmware:*:*:*:*:*:*:*:* Versions before 2020-08-10 Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:thinkcentre_m920q:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:o:lenovo:thinkcentre_m920z_firmware:*:*:*:*:*:*:*:* Versions before 2020-08-10 Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:thinkcentre_m920z:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:o:lenovo:thinkstation_p330t_firmware:*:*:*:*:*:*:*:* Versions before 2020-08-10 Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:thinkstation_p330t:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:o:lenovo:thinkstation_p330s_firmware:*:*:*:*:*:*:*:* Versions before 2020-08-10 Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:thinkstation_p330s:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:o:lenovo:thinkstation_p330_tiny_firmware:*:*:*:*:*:*:*:* Versions before 2020-08-10 Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:thinkstation_p330_tiny:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:o:lenovo:thinkstation_p340t_firmware:*:*:*:*:*:*:*:* Versions before 2020-08-10 Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:thinkstation_p340t:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:o:lenovo:thinkstation_p340s_firmware:*:*:*:*:*:*:*:* Versions before 2020-08-10 Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:thinkstation_p340s:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
Remediation
- Fix · CNA Desktop and Workstation systems (Lenovo) Fixed in various
Timeline
- 2026-10-02 Threatist record created from CVE-2020-8353
- 2026-10-03 Alias added: GHSA-2h67-7cm6-5mr3
References
More Lenovo Thinkcentre M80s Firmware vulnerabilities
- TI-2022-23838 Out-of-bounds write in Lenovo ThinkStation BIOS CVSS 3.1HIGH 7.8
- TI-2023-24127 Out-of-bounds read in Lenovo BIOS CVSS 3.1MEDIUM 6.7
- TI-2023-24126 Out-of-bounds read in Lenovo BIOS CVSS 3.1MEDIUM 6.7
- TI-2023-24125 Out-of-bounds read in Lenovo BIOS CVSS 3.1MEDIUM 6.7
- TI-2023-24124 Out-of-bounds read in Lenovo BIOS CVSS 3.1MEDIUM 6.7
- TI-2023-24123 Out-of-bounds read in Lenovo BIOS CVSS 3.1MEDIUM 6.7
Sources
- CVE-2020-8353 · CVE Program
- CVE-2020-8353 · NVD
- FIRST EPSS
- GHSA-2h67-7cm6-5mr3 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences