What’s Vulnerable › Vulnerabilities

CVE-2020-8353

• Severity: medium (CVSS 6.7 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2020-11-11 · updated 2026-06-17
• Weakness: CWE-16

Description

Prior to August 10, 2020, some Lenovo Desktop and Workstation systems were shipped with the Embedded Host Based Configuration (EHBC) feature of Intel AMT enabled. This could allow an administrative user with local access to configure Intel AMT.

Affected products

• Lenovo Thinkcentre M80S Firmware: before 2020-08-10 — fixed in 2020-08-10
• Lenovo Thinkcentre M80T Firmware: before 2020-08-10 — fixed in 2020-08-10
• Lenovo Thinkcentre M90S Firmware: before 2020-08-10 — fixed in 2020-08-10
• Lenovo Thinkcentre M90T Firmware: before 2020-08-10 — fixed in 2020-08-10
• Lenovo Thinkcentre M910Z Firmware: before 2020-08-10 — fixed in 2020-08-10
• Lenovo Thinkcentre M920Q Firmware: before 2020-08-10 — fixed in 2020-08-10
• Lenovo Thinkcentre M920S Firmware: before 2020-08-10 — fixed in 2020-08-10
• Lenovo Thinkcentre M920T Firmware: before 2020-08-10 — fixed in 2020-08-10
• Lenovo Thinkcentre M920Z Firmware: before 2020-08-10 — fixed in 2020-08-10
• Lenovo Thinkstation P330 Tiny Firmware: before 2020-08-10 — fixed in 2020-08-10
• Lenovo Thinkstation P330S Firmware: before 2020-08-10 — fixed in 2020-08-10
• Lenovo Thinkstation P330T Firmware: before 2020-08-10 — fixed in 2020-08-10
• Lenovo Thinkstation P340S Firmware: before 2020-08-10 — fixed in 2020-08-10
• Lenovo Thinkstation P340T Firmware: before 2020-08-10 — fixed in 2020-08-10

How to fix

Upgrade to a fixed version: Lenovo Thinkcentre M80S Firmware 2020-08-10; Lenovo Thinkcentre M80T Firmware 2020-08-10; Lenovo Thinkcentre M90S Firmware 2020-08-10; Lenovo Thinkcentre M90T Firmware 2020-08-10; Lenovo Thinkcentre M910Z Firmware 2020-08-10; Lenovo Thinkcentre M920Q Firmware 2020-08-10; Lenovo Thinkcentre M920S Firmware 2020-08-10; Lenovo Thinkcentre M920T Firmware 2020-08-10; Lenovo Thinkcentre M920Z Firmware 2020-08-10; Lenovo Thinkstation P330 Tiny Firmware 2020-08-10; Lenovo Thinkstation P330S Firmware 2020-08-10; Lenovo Thinkstation P330T Firmware 2020-08-10. Check the vendor advisory for mitigations.

References

• https://support.lenovo.com/us/en/product_security/LEN-44725
• https://support.lenovo.com/us/en/product_security/LEN-44725

Get alerted when CVE-2020-8353 or the next vulnerability affects your stack