CVE-2020-8332
MEDIUM
6.4
CVSS Score
Published: October 14, 2020 at 09:25 PM UTC
Updated: June 17, 2026 at 03:26 AM UTC
38 products affected across 2 vendorsSystem X3750 M4 FirmwareSystem X3530 M4 FirmwareFlex System X220 Firmware
Using System x by Lenovo?
Get instant alerts when new vulnerabilities affect System x - before attackers find them.
Real-time alertsTrack your software stackFree plan available
Severity
MEDIUM6.4
Exploit prediction
EPSS 0.2%
Description
A potential vulnerability in the SMI callback function used in the legacy BIOS mode USB drivers in some legacy Lenovo and IBM System x servers may allow arbitrary code execution. Servers operating in UEFI mode are not affected.
Affected
Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.
v < tke170b
Affected range stops below tke170b, so it looks safe — our inference, not a vendor statement
lenovo-bladecenter-hs23 (same device)
v < ahe172b
Affected range stops below ahe172b, so it looks safe — our inference, not a vendor statement
lenovo-bladecenter-hs23e (same device)
v < cge128a
Affected range stops below cge128a, so it looks safe — our inference, not a vendor statement
lenovo-compute-node-x440 (same device)
v < kse170b
Affected range stops below kse170b, so it looks safe — our inference, not a vendor statement
lenovo-flex-system-x220 (same device)
v < b2e172b
Affected range stops below b2e172b, so it looks safe — our inference, not a vendor statement
lenovo-flex-system-x240 (same device)
v < cne172b
Affected range stops below cne172b, so it looks safe — our inference, not a vendor statement
lenovo-flex-system-x440 (same device)
v < tde168b
Affected range stops below tde168b, so it looks safe — our inference, not a vendor statement
lenovo-idataplex-dx360-m4 (same device)
v < tde168b
Affected range stops below tde168b, so it looks safe — our inference, not a vendor statement
lenovo-idataplex-dx360-m4-water-cooled (same device)
v < fhe132b
Affected range stops below fhe132b, so it looks safe — our inference, not a vendor statement
lenovo-nextscale-nx360-m4 (same device)
v < yae166b
Affected range stops below yae166b, so it looks safe — our inference, not a vendor statement
lenovo-system-x3300-m4 (same device)
Remediation
No guide yetNo remediation guidance has been written for this CVE yet. What the record does show:
Patch and advisory references
References (1)
x_refsource_MISCVendor Advisory
Source: [email protected]
https://support.lenovo.com/us/en/product_security/LEN-38625CVSS
6.4MEDIUMlenovo
- Attack Vector
- LOCAL
- Complexity
- HIGH
- Privileges
- HIGH
- User Interaction
- NONE
- Scope
- UNCHANGED
- Confidentiality
- HIGH
- Integrity
- HIGH
- Availability
- HIGH
Vector?
Quick Info
StatusMODIFIED
CWE
CWE-367
Get alerted
Stop reading CVE feeds looking for your own stack
Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.
Free plan, no card