What is the CVSS score of CVE-2020-8322?

CVE-2020-8322 has a CVSS 3.1 base score of 6.7 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

330 14Ast Firmware CVE-2020-8322

MEDIUM

2020-06-09 psirt@lenovo.com

RCE Lenovo 330 14Ast Firmware 330 15Ast Firmware 330 17Ast Firmware 340C 15Api Firmware 340C 15Ast Firmware 720S Touch 15Ikb Firmware 720S 15Ikb Firmware 730S 13Iwl Firmware C640 Iml Firmware E42 80 Firmware E52 80 Firmware K22 80 Firmware V720 12 Firmware K32 80 Kbl Firmware K32 80 Skl Firmware Miix 720 12Ikb Firmware S145 14Api Firmware S145 14Ast Firmware S145 15Api Firmware S145 15Ast Firmware S540 13Api Firmware S750 Iil Firmware S940 14Iwl Firmware Thinkbook 13S Iwl Firmware Thinkbook 14S Iwl Firmware V110 14Ast Firmware V110 14Ikb Firmware V110 15Ast Firmware V130 15Igm Firmware V130 15Ikb Firmware V310 15Igm Firmware V330 15Igm Firmware V330 15Ikb Firmware V330 15Isk Firmware V340 Iil Firmware V340 Iml Firmware V540S 13 Firmware 14Iwl Firmware V730 13Ikb Firmware V730 13Isk Firmware V730 15Ikb Firmware Wei5 15Ikb Firmware Xiaoxin 14 Ast Qc 2019 Firmware Xx 14Api Qc 2019 Firmware Yoga S730 13Iwl Firmware Yoga S940 14Iwl Firmware 6 Pro 13 Iwl Firmware 6 Pro 14 Iwl Firmware E53 80 Firmware K3 Firmware K4 Iwl Firmware

6.7

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.7 MEDIUM

AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

CVE Published

Jun 09, 2020 - 20:15 nvd

MEDIUM 6.7

DescriptionNVD

A potential vulnerability in the SMI callback function used in the Legacy USB driver in some Lenovo Notebook and ThinkStation models may allow arbitrary code execution.

AnalysisAI

A potential vulnerability in the SMI callback function used in the Legacy USB driver in some Lenovo Notebook and ThinkStation models may allow arbitrary code execution. Rated medium severity (CVSS 6.7), this vulnerability is low attack complexity. No vendor patch available.

Technical ContextAI

A potential vulnerability in the SMI callback function used in the Legacy USB driver in some Lenovo Notebook and ThinkStation models may allow arbitrary code execution. Affected products include: Lenovo 330-14Ast Firmware, Lenovo 330-15Ast Firmware, Lenovo 330-17Ast Firmware, Lenovo 340C-15Api Firmware, Lenovo 340C-15Ast Firmware.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.