Vulnerability · Published Oct 14, 2020 · Assigned by lenovo

CVE-2020-8332

Medium 6.4

In plain English

A medium-severity security flaw in System x from IBM. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 14% of all known vulnerabilities).

Severity (CVSS 3.1)6.4Medium

Exploit odds (30 days)0.2%top 86.2% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

A potential vulnerability in the SMI callback function used in the legacy BIOS mode USB drivers in some legacy Lenovo and IBM System x servers may allow arbitrary code execution. Servers operating in UEFI mode are not affected.

Affected products (as reported)

Vendor	Product	Versions
Lenovo	System x	various
IBM	System x	various

Weakness: CWE-367 · Vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

References

https://support.lenovo.com/us/en/product_security/LEN-38625 x_refsource_MISC