High severity · published Sep 24, 2020
CVE-2020-8333
A potential vulnerability in the SMI callback function used in the EEPROM driver in some Lenovo Desktops and ThinkStation models may allow arbitrary code execution
7.8
CVSS
0.3%
EPSS
No
On KEV
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 27% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
6F
63 Firmware · Lenovo
before fckt98a · source: NVD
HF
H50-30g Firmware · Lenovo
before fckt98a · source: NVD
MF
M4500 Firmware · Lenovo
before fckt98a · source: NVD
MF
M4550 Firmware · Lenovo
before fckt98a · source: NVD
Q4
Qitian 4500 Firmware · Lenovo
before fckt98a · source: NVD
QB
Qitian B4550 Firmware · Lenovo
before fckt98a · source: NVD
QM
Qitian M4550 Firmware · Lenovo
before fckt98a · source: NVD
TE
Thinkcentre E73 Firmware · Lenovo
before fckt98a · source: NVD
TE
Thinkcentre E73s Firmware · Lenovo
before fckt98a · source: NVD
TE
Thinkcentre E93 Firmware · Lenovo
before fbktdea · source: NVD
TM
Thinkcentre M4500k Firmware · Lenovo
before fckt98a · source: NVD
TM
Thinkcentre M4500q Firmware · Lenovo
before fhkt85a · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-8333
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-8333
Patch
https://support.lenovo.com/us/en/product_security/LEN-30042
More from 63 Firmware
9.8
CVE-2019-6188
The BIOS tamper detection mechanism was not triggered in Lenovo ThinkPad T460p, BIOS versions up to R07ET90W, and T470p, BIOS versions up to R0FET50W, which may allow for…
6.8
CVE-2017-3753
A vulnerability has been identified in some Lenovo products that use UEFI (BIOS) code developed by American Megatrends, Inc
6.4
CVE-2019-6172
A potential vulnerability in the SMI callback function used in Legacy USB driver using passed parameter without sufficient checking in some Lenovo ThinkPad models may allow…
6.4
CVE-2019-6170
A potential vulnerability in the SMI callback function used in the Legacy USB driver using boot services structure in runtime phase in some Lenovo ThinkPad models may allow…