CVE-2020-8353 json
Prior to August 10, 2020, some Lenovo Desktop and Workstation systems were shipped with the Embedded Host Based Configuration (EHBC) featur…
published 2020-11-11 5 y ago modified 2026-06-17 4 mo ago also EUVD-2020-29220
- cvss
- 6.7
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.6%
- EPSS 0.6% chance of exploitation in 30 days, percentile 46%
- public exploits
- 0
- none known
Summary
Prior to August 10, 2020, some Lenovo Desktop and Workstation systems were shipped with the Embedded Host Based Configuration (EHBC) feature of Intel AMT enabled. This could allow an administrative user with local access to configure Intel AMT.
Patch / fix
- lenovo thinkcentre_m80t_firmware 2020-08-10
- lenovo thinkcentre_m80s_firmware 2020-08-10
- lenovo thinkcentre_m90t_firmware 2020-08-10
- lenovo thinkcentre_m90s_firmware 2020-08-10
- lenovo thinkcentre_m910z_firmware 2020-08-10
- lenovo thinkcentre_m920s_firmware 2020-08-10
- lenovo thinkcentre_m920t_firmware 2020-08-10
- lenovo thinkcentre_m920q_firmware 2020-08-10
- lenovo thinkcentre_m920z_firmware 2020-08-10
- lenovo thinkstation_p330t_firmware 2020-08-10
- lenovo thinkstation_p330s_firmware 2020-08-10
- lenovo thinkstation_p330_tiny_firmware 2020-08-10
- lenovo thinkstation_p340t_firmware 2020-08-10
- lenovo thinkstation_p340s_firmware 2020-08-10
Exploit prediction
0.55% chance of exploitation in the next 30 days, higher than 46% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- support.lenovo.com https://support.lenovo.com/us/en/product_security/LEN-44725 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 6.7 | CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H |
| NVD | 3.1 | 6.7 | CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 4.6 | AV:L/AC:L/Au:N/C:P/I:P/A:P |
Affected products
- Lenovo Desktop and Workstation systems
Classification
- Weakness
-
- CWE-16 Configuration
References
-
support.lenovo.com
/us/en/product_security/LEN-44725
exploit, vendor-advisory
Sources
- CVE List CVE-2020-8353
- NVD CVE-2020-8353
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.