CVE-2020-8352 Security feature bypass in BIOS
Lenovo BIOS fails to detect SATA configuration changes, allowing attackers to bypass security controls intended to prevent unauthorized hardware modifications.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-8352?
CVE-2020-8352 is a low-severity vulnerability in Lenovo BIOS, published on 11 Nov 2020. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In some Lenovo Desktop models, the Configuration Change Detection BIOS setting failed to detect SATA configuration changes.
Weakness: CWE-358
Which versions are affected by CVE-2020-8352?
It affects 16 products.
Products include Lenovo Qitian 4500 Firmware, Lenovo Qitian B4550 Firmware, Lenovo Qitian M4550 Firmware, Lenovo Thinkcentre E73 Firmware, Lenovo Thinkcentre M4500k Firmware, Lenovo Thinkcentre M4500s Firmware and 10 more.
How do I fix CVE-2020-8352?
No fix has been published for CVE-2020-8352 yet. Limit exposure of the affected software until one is available.
Is CVE-2020-8352 being exploited?
There is no known exploitation of CVE-2020-8352 in the wild and no public exploit code.
Sources
Also known as GHSA-xvgf-q2mq-jv66.