Low severity · published Nov 11, 2020
CVE-2020-8352
In some Lenovo Desktop models, the Configuration Change Detection BIOS setting failed to detect SATA configuration changes
2.4
CVSS
0.3%
EPSS
No
On KEV
Description
In some Lenovo Desktop models, the Configuration Change Detection BIOS setting failed to detect SATA configuration changes.
CVSS vector
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Attack vector
Physical
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 24% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
Q4
Qitian 4500 Firmware · Lenovo
All versions, or not specified · source: NVD
QB
Qitian B4550 Firmware · Lenovo
All versions, or not specified · source: NVD
QM
Qitian M4550 Firmware · Lenovo
All versions, or not specified · source: NVD
TE
Thinkcentre E73 Firmware · Lenovo
All versions, or not specified · source: NVD
TM
Thinkcentre M4500k Firmware · Lenovo
All versions, or not specified · source: NVD
TM
Thinkcentre M4500s Firmware · Lenovo
All versions, or not specified · source: NVD
TM
Thinkcentre M4500t Firmware · Lenovo
All versions, or not specified · source: NVD
TM
Thinkcentre M73 Firmware · Lenovo
All versions, or not specified · source: NVD
YA
Yangtian Afh81 Firmware · Lenovo
All versions, or not specified · source: NVD
YM
Yangtian MC H81 Firmware · Lenovo
All versions, or not specified · source: NVD
YM
Yangtian MF Firmware · Lenovo
All versions, or not specified · source: NVD
YM
Yangtian MS Firmware · Lenovo
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-8352
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-8352
Vendor Advisory
https://support.lenovo.com/us/en/product_security/LEN-49266
More from Qitian 4500 Firmware
9.8
CVE-2019-6188
The BIOS tamper detection mechanism was not triggered in Lenovo ThinkPad T460p, BIOS versions up to R07ET90W, and T470p, BIOS versions up to R0FET50W, which may allow for…
7.8
CVE-2020-8333
A potential vulnerability in the SMI callback function used in the EEPROM driver in some Lenovo Desktops and ThinkStation models may allow arbitrary code execution
6.4
CVE-2019-6172
A potential vulnerability in the SMI callback function used in Legacy USB driver using passed parameter without sufficient checking in some Lenovo ThinkPad models may allow…
6.4
CVE-2019-6170
A potential vulnerability in the SMI callback function used in the Legacy USB driver using boot services structure in runtime phase in some Lenovo ThinkPad models may allow…
3.3
CVE-2019-6156
In Lenovo systems, SMM BIOS Write Protection is used to prevent writes to SPI Flash