CVE-2020-8336

published 2020-06-09

CVE-2020-8336: Lenovo implemented Intel CSME Anti-rollback ARB protections on some ThinkPad models to prevent roll back of CSME Firmware in flash.

Priority P4 22 medium 6.8 CVSS 3.1

AV P AC L PR N UI N S U C H I H A H

Lenovo implemented Intel CSME Anti-rollback ARB protections on some ThinkPad models to prevent roll back of CSME Firmware in flash.

Affected

35 ranges · showing 25

Vendor	Product	Version range	Fixed in
lenovo	bios	—	—
lenovo	thinkpad_e14_firmware	< 2020-07-10	2020-07-10
lenovo	thinkpad_e15_firmware	< 2020-07-10	2020-07-10
lenovo	thinkpad_e490_firmware	< 2020-07-10	2020-07-10
lenovo	thinkpad_e490s_firmware	< 2020-07-10	2020-07-10
lenovo	thinkpad_e590_firmware	< 2020-07-10	2020-07-10
lenovo	thinkpad_l13_1st_gen_firmware	< 2020-07-10	2020-07-10
lenovo	thinkpad_l1415_gen_1_firmware	< 2020-07-10	2020-07-10
lenovo	thinkpad_l390_yoga_firmware	< 2020-07-10	2020-07-10
lenovo	thinkpad_l490_firmware	< 2020-07-10	2020-07-10
lenovo	thinkpad_l590_firmware	< 2020-07-10	2020-07-10
lenovo	thinkpad_p1_firmware	< n2eet47w	n2eet47w
lenovo	thinkpad_p1_firmware	< n2oet44w	n2oet44w
lenovo	thinkpad_p43s_firmware	< n2iet88w	n2iet88w
lenovo	thinkpad_p52_firmware	< n2cet51w-1.34	n2cet51w-1.34
lenovo	thinkpad_p53_firmware	< n2net37w	n2net37w
lenovo	thinkpad_p53s_firmware	< n2iet88w	n2iet88w
lenovo	thinkpad_p72_firmware	< n2cet51w	n2cet51w
lenovo	thinkpad_p73_firmware	< n2net37w	n2net37w
lenovo	thinkpad_r14_firmware	< 2020-07-10	2020-07-10
lenovo	thinkpad_r490_firmware	< 2020-07-10	2020-07-10
lenovo	thinkpad_r590_firmware	< 2020-07-10	2020-07-10
lenovo	thinkpad_s2_yoga_4th_gen_firmware	< 2020-07-10	2020-07-10
lenovo	thinkpad_s3_firmware	< 2020-07-10	2020-07-10
lenovo	thinkpad_s3_gen_2_firmware	< 2020-07-10	2020-07-10

CVSS provenance

nvd v3.1 6.8 MEDIUM CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

nvd v2.0 4.6 MEDIUM AV:L/AC:L/Au:N/C:P/I:P/A:P

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.