What’s Vulnerable › Vulnerabilities

CVE-2020-8323

• Severity: medium (CVSS 6.7 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2020-06-09 · updated 2026-06-17

Description

A potential vulnerability in the SMI callback function used in the Legacy SD driver in some Lenovo ThinkPad, ThinkStation, and Lenovo Notebook models may allow arbitrary code execution.

Affected products

• Lenovo 14Iwl Firmware: all versions
• Lenovo 330-14Ast Firmware: all versions
• Lenovo 330-15Ast Firmware: all versions
• Lenovo 330-17Ast Firmware: all versions
• Lenovo 340C-15Api Firmware: all versions
• Lenovo 340C-15Ast Firmware: all versions
• Lenovo 6 Pro-13-Iwl Firmware: all versions
• Lenovo 6 Pro-14-Iwl Firmware: all versions
• Lenovo 720S-15Ikb Firmware: all versions
• Lenovo 720S Touch-15Ikb Firmware: all versions
• Lenovo 730S-13Iwl Firmware: all versions
• Lenovo C640-Iml Firmware: all versions
• Lenovo E42-80 Firmware: all versions
• Lenovo E52-80 Firmware: all versions
• Lenovo E53-80 Firmware: all versions
• Lenovo K22-80 Firmware: all versions
• Lenovo K32-80 Kbl Firmware: all versions
• Lenovo K32-80 Skl Firmware: all versions
• Lenovo K3 Firmware: all versions
• Lenovo K4-Iwl Firmware: all versions
• Lenovo Miix 720-12Ikb Firmware: all versions
• Lenovo S145-14Api Firmware: all versions
• Lenovo S145-14Ast Firmware: all versions
• Lenovo S145-15Api Firmware: all versions
• Lenovo S145-15Ast Firmware: all versions
• Lenovo S540-13Api Firmware: all versions
• Lenovo S750-Iil Firmware: all versions
• Lenovo S940-14Iwl Firmware: all versions
• Lenovo Thinkbook 13S-Iwl Firmware: all versions
• Lenovo Thinkbook 14S-Iwl Firmware: all versions

How to fix

Upgrade to a fixed version: Lenovo Thinkpad 11E Firmware 2020-07-10; Lenovo Thinkpad 11E Yoga Gen 6 Firmware 2020-07-10; Lenovo Thinkpad 13 2Nd Gen Firmware 2020-07-10; Lenovo Thinkpad 13 Firmware 2020-07-10; Lenovo Thinkpad A275 Firmware 2020-07-10; Lenovo Thinkpad A285 Firmware 2020-07-10; Lenovo Thinkpad A475 Firmware 2020-07-10; Lenovo Thinkpad A485 Firmware 2020-07-10; Lenovo Thinkpad E14 Firmware 2020-07-10; Lenovo Thinkpad E15 Firmware 2020-07-10; Lenovo Thinkpad E455 Firmware 2020-07-10; Lenovo Thinkpad E460 Firmware 2020-07-10. Check the vendor advisory for mitigations.

References

• https://support.lenovo.com/us/en/product_security/LEN-30042
• https://support.lenovo.com/us/en/product_security/LEN-30042

Get alerted when CVE-2020-8323 or the next vulnerability affects your stack