Skip to main content

Thinkpad A275 Firmware CVE-2020-8335

MEDIUM
2020-09-01 psirt@lenovo.com
Lenovo Authentication Bypass Thinkpad A275 Firmware Thinkpad A285 Firmware Thinkpad A475 Firmware Thinkpad A485 Firmware Thinkpad T495 Drift Firmware Thinkpad T495S Jazz Firmware Thinkpad X1 Carbon 20Bx Firmware Thinkpad X395 Firmware
6.8
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
6.8 MEDIUM
AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Physical
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

1
CVE Published
Sep 01, 2020 - 22:15 nvd
MEDIUM 6.8

DescriptionNVD

The BIOS tamper detection mechanism was not triggered in Lenovo ThinkPad A285, BIOS versions up to r0xuj70w; A485, BIOS versions up to r0wuj65w; T495 BIOS versions up to r12uj55w; T495s/X395, BIOS versions up to r13uj47w, while the emergency-reset button is pressed which may allow for unauthorized access.

AnalysisAI

The BIOS tamper detection mechanism was not triggered in Lenovo ThinkPad A285, BIOS versions up to r0xuj70w; A485, BIOS versions up to r0wuj65w; T495 BIOS versions up to r12uj55w; T495s/X395, BIOS. Rated medium severity (CVSS 6.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.

Technical ContextAI

The BIOS tamper detection mechanism was not triggered in Lenovo ThinkPad A285, BIOS versions up to r0xuj70w; A485, BIOS versions up to r0wuj65w; T495 BIOS versions up to r12uj55w; T495s/X395, BIOS versions up to r13uj47w, while the emergency-reset button is pressed which may allow for unauthorized access. Affected products include: Lenovo Thinkpad A275 Firmware, Lenovo Thinkpad A285 Firmware, Lenovo Thinkpad A475 Firmware, Lenovo Thinkpad A485 Firmware, Lenovo Thinkpad T495 Drift Firmware.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Thinkpad A275 Firmware

View all
CVE-2020-8334 MEDIUM
6.8 Jun 09

The BIOS tamper detection mechanism was not triggered in Lenovo ThinkPad T495s, X395, T495, A485, A285, A475, A275 which
CVE-2020-8320 MEDIUM
6.8 Jun 09

An internal shell was included in BIOS image in some ThinkPad models that could allow escalation of privilege. Rated med
CVE-2020-8323 MEDIUM
6.7 Jun 09

A potential vulnerability in the SMI callback function used in the Legacy SD driver in some Lenovo ThinkPad, ThinkStatio
CVE-2019-10724 MEDIUM
6.5 Aug 29

There is a vulnerability with the Dolby DAX2 API system services in which a low-privileged user can terminate arbitrary

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2012-1723 CRITICAL POC
9.8
CVE-2017-10271 HIGH POC
7.5
CVE-2015-1427 CRITICAL POC
9.8
CVE-2025-3248 CRITICAL POC
9.8

Share

CVE-2020-8335 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy