CVE-2020-8353

published 2020-11-11

CVE-2020-8353: Prior to August 10, 2020, some Lenovo Desktop and Workstation systems were shipped with the Embedded Host Based Configuration (EHBC) feature of Intel AMT…

Priority P4 27 medium 6.7 CVSS 3.1

AV L AC L PR H UI N S U C H I H A H

Prior to August 10, 2020, some Lenovo Desktop and Workstation systems were shipped with the Embedded Host Based Configuration (EHBC) feature of Intel AMT enabled. This could allow an administrative user with local access to configure Intel AMT.

Affected

15 ranges

Vendor	Product	Version range	Fixed in
lenovo	desktop_and_workstation_systems	>= unspecified < various	various
lenovo	thinkcentre_m80s_firmware	< 2020-08-10	2020-08-10
lenovo	thinkcentre_m80t_firmware	< 2020-08-10	2020-08-10
lenovo	thinkcentre_m90s_firmware	< 2020-08-10	2020-08-10
lenovo	thinkcentre_m90t_firmware	< 2020-08-10	2020-08-10
lenovo	thinkcentre_m910z_firmware	< 2020-08-10	2020-08-10
lenovo	thinkcentre_m920q_firmware	< 2020-08-10	2020-08-10
lenovo	thinkcentre_m920s_firmware	< 2020-08-10	2020-08-10
lenovo	thinkcentre_m920t_firmware	< 2020-08-10	2020-08-10
lenovo	thinkcentre_m920z_firmware	< 2020-08-10	2020-08-10
lenovo	thinkstation_p330_tiny_firmware	< 2020-08-10	2020-08-10
lenovo	thinkstation_p330s_firmware	< 2020-08-10	2020-08-10
lenovo	thinkstation_p330t_firmware	< 2020-08-10	2020-08-10
lenovo	thinkstation_p340s_firmware	< 2020-08-10	2020-08-10
lenovo	thinkstation_p340t_firmware	< 2020-08-10	2020-08-10

CVSS provenance

nvd v3.1 6.7 MEDIUM CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

nvd v2.0 4.6 MEDIUM AV:L/AC:L/Au:N/C:P/I:P/A:P

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-16