CVE-2020-8336

Severity: medium (CVSS 6.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2020-06-09 · updated 2026-06-17

Description

Lenovo implemented Intel CSME Anti-rollback ARB protections on some ThinkPad models to prevent roll back of CSME Firmware in flash.

Affected products

Lenovo Thinkpad E14 Firmware: before 2020-07-10 — fixed in 2020-07-10
Lenovo Thinkpad E15 Firmware: before 2020-07-10 — fixed in 2020-07-10
Lenovo Thinkpad E490 Firmware: before 2020-07-10 — fixed in 2020-07-10
Lenovo Thinkpad E490S Firmware: before 2020-07-10 — fixed in 2020-07-10
Lenovo Thinkpad E590 Firmware: before 2020-07-10 — fixed in 2020-07-10
Lenovo Thinkpad L13 1St Gen Firmware: before 2020-07-10 — fixed in 2020-07-10
Lenovo Thinkpad L1415 Gen 1 Firmware: before 2020-07-10 — fixed in 2020-07-10
Lenovo Thinkpad L390 Yoga Firmware: before 2020-07-10 — fixed in 2020-07-10
Lenovo Thinkpad L490 Firmware: before 2020-07-10 — fixed in 2020-07-10
Lenovo Thinkpad L590 Firmware: before 2020-07-10 — fixed in 2020-07-10
Lenovo Thinkpad P1 (20Mx) Firmware: before n2eet47w — fixed in n2eet47w
Lenovo Thinkpad P1 (20Qx) Firmware: before n2oet44w — fixed in n2oet44w
Lenovo Thinkpad P43S (20Rx) Firmware: before n2iet88w — fixed in n2iet88w
Lenovo Thinkpad P52 (20Mx) Firmware: before n2cet51w-1.34 — fixed in n2cet51w-1.34
Lenovo Thinkpad P53 (20Qx) Firmware: before n2net37w — fixed in n2net37w
Lenovo Thinkpad P53S (20Nx) Firmware: before n2iet88w — fixed in n2iet88w
Lenovo Thinkpad P72 (20Mx) Firmware: before n2cet51w — fixed in n2cet51w
Lenovo Thinkpad P73 (20Qx) Firmware: before n2net37w — fixed in n2net37w
Lenovo Thinkpad R14 Firmware: before 2020-07-10 — fixed in 2020-07-10
Lenovo Thinkpad R490 Firmware: before 2020-07-10 — fixed in 2020-07-10
Lenovo Thinkpad R590 Firmware: before 2020-07-10 — fixed in 2020-07-10
Lenovo Thinkpad S2 Yoga 4Th Gen Firmware: before 2020-07-10 — fixed in 2020-07-10
Lenovo Thinkpad S3 Firmware: before 2020-07-10 — fixed in 2020-07-10
Lenovo Thinkpad S3 Gen 2 Firmware: before 2020-07-10 — fixed in 2020-07-10
Lenovo Thinkpad T490 (20Nx) Firmware: before n2iet88w — fixed in n2iet88w
Lenovo Thinkpad T490 (20Qx) Firmware: before n2iet88w — fixed in n2iet88w
Lenovo Thinkpad T490 (20Rx) Firmware: before n2iet88w — fixed in n2iet88w
Lenovo Thinkpad T490S (20Nx) Firmware: before n2jet87w — fixed in n2jet87w
Lenovo Thinkpad T590 (20Nx) Firmware: before n2iet88w — fixed in n2iet88w
Lenovo Thinkpad X1 Carbon (20Qx) Firmware: before n2het47w — fixed in n2het47w

How to fix

Upgrade to a fixed version: Lenovo Thinkpad E14 Firmware 2020-07-10; Lenovo Thinkpad E15 Firmware 2020-07-10; Lenovo Thinkpad E490 Firmware 2020-07-10; Lenovo Thinkpad E490S Firmware 2020-07-10; Lenovo Thinkpad E590 Firmware 2020-07-10; Lenovo Thinkpad L13 1St Gen Firmware 2020-07-10; Lenovo Thinkpad L1415 Gen 1 Firmware 2020-07-10; Lenovo Thinkpad L390 Yoga Firmware 2020-07-10; Lenovo Thinkpad L490 Firmware 2020-07-10; Lenovo Thinkpad L590 Firmware 2020-07-10; Lenovo Thinkpad P1 (20Mx) Firmware n2eet47w; Lenovo Thinkpad P1 (20Qx) Firmware n2oet44w. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2020-8336 or the next vulnerability affects your stack