What’s Vulnerable › Vulnerabilities

CVE-2020-8320

• Severity: medium (CVSS 6.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2020-06-09 · updated 2026-06-17
• Weakness: CWE-489

Description

An internal shell was included in BIOS image in some ThinkPad models that could allow escalation of privilege.

Affected products

• Lenovo Thinkpad 11E Firmware: before 2020-07-10 — fixed in 2020-07-10
• Lenovo Thinkpad 11E Yoga Gen 6 Firmware: before 2020-07-10 — fixed in 2020-07-10
• Lenovo Thinkpad 13 2Nd Gen Firmware: before 2020-07-10 — fixed in 2020-07-10
• Lenovo Thinkpad 13 Firmware: before 2020-07-10 — fixed in 2020-07-10
• Lenovo Thinkpad A275 Firmware: before 2020-07-10 — fixed in 2020-07-10
• Lenovo Thinkpad A285 Firmware: before 2020-07-10 — fixed in 2020-07-10
• Lenovo Thinkpad A475 Firmware: before 2020-07-10 — fixed in 2020-07-10
• Lenovo Thinkpad A485 Firmware: before 2020-07-10 — fixed in 2020-07-10
• Lenovo Thinkpad E14 Firmware: before 2020-07-10 — fixed in 2020-07-10
• Lenovo Thinkpad E15 Firmware: before 2020-07-10 — fixed in 2020-07-10
• Lenovo Thinkpad E455 Firmware: before 2020-07-10 — fixed in 2020-07-10
• Lenovo Thinkpad E460 Firmware: before 2020-07-10 — fixed in 2020-07-10
• Lenovo Thinkpad E465 Firmware: before 2020-07-10 — fixed in 2020-07-10
• Lenovo Thinkpad E470 Firmware: before 2020-07-10 — fixed in 2020-07-10
• Lenovo Thinkpad E475 Firmware: before 2020-07-10 — fixed in 2020-07-10
• Lenovo Thinkpad E480 Firmware: before 2020-07-10 — fixed in 2020-07-10
• Lenovo Thinkpad E485 Firmware: before 2020-07-10 — fixed in 2020-07-10
• Lenovo Thinkpad E490 Firmware: before 2020-07-10 — fixed in 2020-07-10
• Lenovo Thinkpad E490S Firmware: before 2020-07-10 — fixed in 2020-07-10
• Lenovo Thinkpad E555 Firmware: before 2020-07-10 — fixed in 2020-07-10
• Lenovo Thinkpad E560 Firmware: before 2020-07-10 — fixed in 2020-07-10
• Lenovo Thinkpad E560P Firmware: before 2020-07-10 — fixed in 2020-07-10
• Lenovo Thinkpad E565 Firmware: before 2020-07-10 — fixed in 2020-07-10
• Lenovo Thinkpad E570 Firmware: before 2020-07-10 — fixed in 2020-07-10
• Lenovo Thinkpad E575 Firmware: before 2020-07-10 — fixed in 2020-07-10
• Lenovo Thinkpad E580 Firmware: before 2020-07-10 — fixed in 2020-07-10
• Lenovo Thinkpad E585 Firmware: before 2020-07-10 — fixed in 2020-07-10
• Lenovo Thinkpad E590 Firmware: before 2020-07-10 — fixed in 2020-07-10
• Lenovo Thinkpad L13 Firmware: before 2020-07-10 — fixed in 2020-07-10
• Lenovo Thinkpad L1415 Firmware: before 2020-07-10 — fixed in 2020-07-10

How to fix

Upgrade to a fixed version: Lenovo Thinkpad 11E Firmware 2020-07-10; Lenovo Thinkpad 11E Yoga Gen 6 Firmware 2020-07-10; Lenovo Thinkpad 13 2Nd Gen Firmware 2020-07-10; Lenovo Thinkpad 13 Firmware 2020-07-10; Lenovo Thinkpad A275 Firmware 2020-07-10; Lenovo Thinkpad A285 Firmware 2020-07-10; Lenovo Thinkpad A475 Firmware 2020-07-10; Lenovo Thinkpad A485 Firmware 2020-07-10; Lenovo Thinkpad E14 Firmware 2020-07-10; Lenovo Thinkpad E15 Firmware 2020-07-10; Lenovo Thinkpad E455 Firmware 2020-07-10; Lenovo Thinkpad E460 Firmware 2020-07-10. Check the vendor advisory for mitigations.

References

• https://support.lenovo.com/us/en/product_security/LEN-30042
• https://support.lenovo.com/us/en/product_security/LEN-30042

Get alerted when CVE-2020-8320 or the next vulnerability affects your stack