What is the CVSS score of CVE-2020-8341?

CVE-2020-8341 has a CVSS 3.1 base score of 2.4 (Low). CVSS vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.3%.

Thinkpad T490 20Nx Firmware CVE-2020-8341

LOW

2020-09-01 psirt@lenovo.com

Lenovo Information Disclosure Thinkpad T490 20Nx Firmware Thinkpad T490 20Qx Firmware Thinkpad T490 20Rx Firmware Thinkpad T490S 20Nx Firmware Thinkpad T495 Drift Firmware Thinkpad T590 20Nx Firmware Thinkpad X1 Carbon 20Qx Firmware Thinkpad X1 Yoga 20Qx Firmware Thinkpad X390 20Qx Firmware Thinkpad X390 20Sx Firmware

2.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

2.4 LOW

AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Attack Vector

Physical

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

CVE Published

Sep 01, 2020 - 22:15 nvd

LOW 2.4

DescriptionNVD

AnalysisAI

In Lenovo systems, SMM BIOS Write Protection is used to prevent writes to SPI Flash. Rated low severity (CVSS 2.4), this vulnerability is no authentication required, low attack complexity. No vendor patch available.

Technical ContextAI

In Lenovo systems, SMM BIOS Write Protection is used to prevent writes to SPI Flash. While this provides sufficient protection, an additional layer of protection is provided by SPI Protected Range Registers (PRx). After resuming from S3 sleep mode in various versions of BIOS for some Lenovo ThinkPad systems, the PRx is not set. This does not impact the SMM BIOS Write Protection, which keeps systems protected. Affected products include: Lenovo Thinkpad T490 \(20Nx\) Firmware, Lenovo Thinkpad T490 \(20Qx\) Firmware, Lenovo Thinkpad T490 \(20Rx\) Firmware, Lenovo Thinkpad T490S \(20Nx\) Firmware, Lenovo Thinkpad T495 Drift Firmware.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.