CVE-2020-8335

Severity: medium (CVSS 6.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2020-09-01 · updated 2026-06-17

Description

The BIOS tamper detection mechanism was not triggered in Lenovo ThinkPad A285, BIOS versions up to r0xuj70w; A485, BIOS versions up to r0wuj65w; T495 BIOS versions up to r12uj55w; T495s/X395, BIOS versions up to r13uj47w, while the emergency-reset button is pressed which may allow for unauthorized access.

Affected products

Lenovo Thinkpad A275 Firmware: before 2020-08-30 — fixed in 2020-08-30
Lenovo Thinkpad A285 Firmware: before 2020-08-30 — fixed in 2020-08-30
Lenovo Thinkpad A475 Firmware: before 2020-08-30 — fixed in 2020-08-30
Lenovo Thinkpad A485 Firmware: before 2020-08-30 — fixed in 2020-08-30
Lenovo Thinkpad T495 Drift Firmware: before 2020-08-30 — fixed in 2020-08-30
Lenovo Thinkpad T495S Jazz Firmware: before 2020-08-30 — fixed in 2020-08-30
Lenovo Thinkpad X1 Carbon (20Bx) Firmware: before n14et54w — fixed in n14et54w
Lenovo Thinkpad X395 Firmware: before 2020-08-30 — fixed in 2020-08-30

How to fix

Upgrade to a fixed version: Lenovo Thinkpad A275 Firmware 2020-08-30; Lenovo Thinkpad A285 Firmware 2020-08-30; Lenovo Thinkpad A475 Firmware 2020-08-30; Lenovo Thinkpad A485 Firmware 2020-08-30; Lenovo Thinkpad T495 Drift Firmware 2020-08-30; Lenovo Thinkpad T495S Jazz Firmware 2020-08-30; Lenovo Thinkpad X1 Carbon (20Bx) Firmware n14et54w; Lenovo Thinkpad X395 Firmware 2020-08-30. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2020-8335 or the next vulnerability affects your stack