CVE-2020-8332

Severity: medium (CVSS 6.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2020-10-14 · updated 2026-06-17
Weakness: CWE-367

Description

A potential vulnerability in the SMI callback function used in the legacy BIOS mode USB drivers in some legacy Lenovo and IBM System x servers may allow arbitrary code execution. Servers operating in UEFI mode are not affected.

Affected products

Lenovo Bladecenter Hs23 Firmware: before tke170b — fixed in tke170b
Lenovo Bladecenter Hs23E Firmware: before ahe172b — fixed in ahe172b
Lenovo Compute Node-X440 Firmware: before cge128a — fixed in cge128a
Lenovo Flex System X220 Firmware: before kse170b — fixed in kse170b
Lenovo Flex System X240 Firmware: before b2e172b — fixed in b2e172b
Lenovo Flex System X440 Firmware: before cne172b — fixed in cne172b
Lenovo Idataplex Dx360 M4 Firmware: before tde168b — fixed in tde168b
Lenovo Idataplex Dx360 M4 Water Cooled Firmware: before tde168b — fixed in tde168b
Lenovo Nextscale Nx360 M4 Firmware: before fhe132b — fixed in fhe132b
Lenovo System X3300 M4 Firmware: before yae166b — fixed in yae166b
Lenovo System X3500 M4 Firmware: before y5e170b — fixed in y5e170b
Lenovo System X3530 M4 Firmware: before bee174b — fixed in bee174b
Lenovo System X3550 M4 Firmware: before d7e174b — fixed in d7e174b
Lenovo System X3630 M4 Firmware: before bee174b — fixed in bee174b
Lenovo System X3650 M4 Bd Firmware: before vve172b — fixed in vve172b
Lenovo System X3650 M4 Firmware: before vve172b — fixed in vve172b
Lenovo System X3650 M4 Hd Firmware: before vve172b — fixed in vve172b
Lenovo System X3750 M4 Firmware: before a5e130a; before koe170b — fixed in a5e130a, koe170b

How to fix

Upgrade to a fixed version: Lenovo Bladecenter Hs23 Firmware tke170b; Lenovo Bladecenter Hs23E Firmware ahe172b; Lenovo Compute Node-X440 Firmware cge128a; Lenovo Flex System X220 Firmware kse170b; Lenovo Flex System X240 Firmware b2e172b; Lenovo Flex System X440 Firmware cne172b; Lenovo Idataplex Dx360 M4 Firmware tde168b; Lenovo Idataplex Dx360 M4 Water Cooled Firmware tde168b; Lenovo Nextscale Nx360 M4 Firmware fhe132b; Lenovo System X3300 M4 Firmware yae166b; Lenovo System X3500 M4 Firmware y5e170b; Lenovo System X3530 M4 Firmware bee174b. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2020-8332 or the next vulnerability affects your stack