CVE Feed

    Dashboard / CVE / CVE-2020-8353

    CVE-2020-8353

    Prior to August 10, 2020, some Lenovo Desktop and Workstation systems were shipped with the Embedded Host Based Configuration (EHBC) feature of Intel AMT enabled. This could allow an administrative user with local access to configure Intel AMT.

    Published:Nov 11, 2020
    Last Modified:Nov 21, 2024
    EPS:Nov 11, 2020
    EPSS Score:0.00049
    CVSS Score:6.7

    Affected Products

    Vendor
    Lenovo
    Product
    Thinkcentre M80s
    Vendor
    Lenovo
    Product
    Thinkcentre M80s Firmware
    Vendor
    Lenovo
    Product
    Thinkcentre M80t
    Vendor
    Lenovo
    Product
    Thinkcentre M80t Firmware
    Vendor
    Lenovo
    Product
    Thinkcentre M90s
    Vendor
    Lenovo
    Product
    Thinkcentre M90s Firmware
    Vendor
    Lenovo
    Product
    Thinkcentre M90t
    Vendor
    Lenovo
    Product
    Thinkcentre M90t Firmware
    Vendor
    Lenovo
    Product
    Thinkcentre M910z
    Vendor
    Lenovo
    Product
    Thinkcentre M910z Firmware
    Vendor
    Lenovo
    Product
    Thinkcentre M920q
    Vendor
    Lenovo
    Product
    Thinkcentre M920q Firmware
    Vendor
    Lenovo
    Product
    Thinkcentre M920s
    Vendor
    Lenovo
    Product
    Thinkcentre M920s Firmware
    Vendor
    Lenovo
    Product
    Thinkcentre M920t
    Vendor
    Lenovo
    Product
    Thinkcentre M920t Firmware
    Vendor
    Lenovo
    Product
    Thinkcentre M920z
    Vendor
    Lenovo
    Product
    Thinkcentre M920z Firmware
    Vendor
    Lenovo
    Product
    Thinkstation P330 Tiny
    Vendor
    Lenovo
    Product
    Thinkstation P330 Tiny Firmware
    Vendor
    Lenovo
    Product
    Thinkstation P330s
    Vendor
    Lenovo
    Product
    Thinkstation P330s Firmware
    Vendor
    Lenovo
    Product
    Thinkstation P330t
    Vendor
    Lenovo
    Product
    Thinkstation P330t Firmware
    Vendor
    Lenovo
    Product
    Thinkstation P340s
    Vendor
    Lenovo
    Product
    Thinkstation P340s Firmware
    Vendor
    Lenovo
    Product
    Thinkstation P340t
    Vendor
    Lenovo
    Product
    Thinkstation P340t Firmware

    Exploits

    https://support.lenovo.com/us/en/product_security/LEN-44725https://support.lenovo.com/us/en/product_security/LEN-44725

    Common Weakness Enumeration

    No CWE recorded yet

    Common Attack Pattern Enumeration and Classification (CAPEC)

    No CAPEC recorded yet

    Related CVEs

    CVE-2023-43577 (CVSS 6.7) — A buffer overflow was reported in the ReFlash module in some Lenovo Desktop products that may allow a local at…
    CVE-2023-43576 (CVSS 6.7) — A buffer overflow was reported in the WMISwSmi module in some Lenovo Desktop products that may allow a local a…
    CVE-2023-43575 (CVSS 6.7) — A buffer overflow was reported in the UltraFunctionTable module in some Lenovo Desktop products that may allow…
    CVE-2023-43574 (CVSS 4.4) — A buffer over-read was reported in the LEMALLDriversConnectedEventHook module in some Lenovo Desktop products …
    CVE-2023-43573 (CVSS 6.7) — A buffer overflow was reported in the LEMALLDriversConnectedEventHook module in some Lenovo Desktop products t…
    CVE-2023-43572 (CVSS 4.4) — A buffer over-read was reported in the BiosExtensionLoader module in some Lenovo Desktop products that may all…
    CVE-2023-45079 (CVSS 6.7) — A memory leakage vulnerability was reported in the NvmramSmm SMM driver that may allow a local attacker with e…
    CVE-2023-45078 (CVSS 6.7) — A memory leakage vulnerability was reported in the DustFilterAlertSmm SMM driver that may allow a local attack…
    CVE-2023-45077 (CVSS 6.7) — A memory leakage vulnerability was reported in the 534D0740 DXE driver that may allow a local attacker with el…
    CVE-2023-45076 (CVSS 6.7) — A memory leakage vulnerability was reported in the 534D0140 DXE driver that may allow a local attacker with el…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High