CVE-2020-8335 Security feature bypass in ThinkPad A285 BIOS
Lenovo ThinkPad BIOS fails to trigger tamper detection when the emergency-reset button is pressed, allowing unauthorized access.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-8335?
CVE-2020-8335 is a medium-severity vulnerability in Lenovo ThinkPad A285 BIOS, published on 1 Sep 2020. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
The BIOS tamper detection mechanism was not triggered in Lenovo ThinkPad A285, BIOS versions up to r0xuj70w; A485, BIOS versions up to r0wuj65w; T495 BIOS versions up to r12uj55w; T495s/X395, BIOS versions up to r13uj47w, while the emergency-reset button is pressed which may allow for unauthorized access.
Which versions are affected by CVE-2020-8335?
It affects 8 products.
Products include Lenovo Thinkpad A275 Firmware, Lenovo Thinkpad A285 Firmware, Lenovo Thinkpad A475 Firmware, Lenovo Thinkpad A485 Firmware, Lenovo Thinkpad T495 Drift Firmware, Lenovo Thinkpad T495s Jazz Firmware and 2 more.
How do I fix CVE-2020-8335?
No fix has been published for CVE-2020-8335 yet. Limit exposure of the affected software until one is available.
Is CVE-2020-8335 being exploited?
There is no known exploitation of CVE-2020-8335 in the wild and no public exploit code.
Other vulnerabilities in Lenovo ThinkPad A285 BIOS
Sources
Also known as GHSA-fvh7-v69p-hj2v.