Details of VAR-202009-1520

ID

VAR-202009-1520

CVE

CVE-2020-8333

TITLE

plural Lenovo Desktop and ThinkStation Vulnerability in the model

Trust: 0.8

sources: JVNDB: JVNDB-2020-011859

DESCRIPTION

A potential vulnerability in the SMI callback function used in the EEPROM driver in some Lenovo Desktops and ThinkStation models may allow arbitrary code execution. plural Lenovo Desktop and ThinkStation There are unspecified vulnerabilities in the model.Information is obtained, information is tampered with, and service is disrupted (DoS) It may be put into a state

Trust: 1.71

sources: NVD: CVE-2020-8333 // JVNDB: JVNDB-2020-011859 // VULMON: CVE-2020-8333

AFFECTED PRODUCTS

vendor:	lenovo	model:	thinkcentre e73	scope:	lt	version:	fckt98a	Trust: 1.0
vendor:	lenovo	model:	thinkcentre m4500s	scope:	lt	version:	fckt98a	Trust: 1.0
vendor:	lenovo	model:	thinkstation e32	scope:	lt	version:	fbktdea	Trust: 1.0
vendor:	lenovo	model:	thinkcentre e93	scope:	lt	version:	fbktdea	Trust: 1.0
vendor:	lenovo	model:	qitian m4550	scope:	lt	version:	fckt98a	Trust: 1.0
vendor:	lenovo	model:	thinkstation d30	scope:	lt	version:	a3kt70a	Trust: 1.0
vendor:	lenovo	model:	63	scope:	lt	version:	fckt98a	Trust: 1.0
vendor:	lenovo	model:	yangtian mc h81	scope:	lt	version:	fckt98a	Trust: 1.0
vendor:	lenovo	model:	thinkcentre m9350z	scope:	lt	version:	fekta2a	Trust: 1.0
vendor:	lenovo	model:	qitian b4550	scope:	lt	version:	fckt98a	Trust: 1.0
vendor:	lenovo	model:	yangtian wcc h81 pci	scope:	lt	version:	fckt98a	Trust: 1.0
vendor:	lenovo	model:	thinkstation s30	scope:	lt	version:	a2kt70a	Trust: 1.0
vendor:	lenovo	model:	m4500	scope:	lt	version:	fckt98a	Trust: 1.0
vendor:	lenovo	model:	thinkcentre e73s	scope:	lt	version:	fckt98a	Trust: 1.0
vendor:	lenovo	model:	thinkstation c30	scope:	lt	version:	a3kt70a	Trust: 1.0
vendor:	lenovo	model:	thinkcentre m93z	scope:	lt	version:	fekta2a	Trust: 1.0
vendor:	lenovo	model:	thinkcentre m4500q	scope:	lt	version:	fhkt85a	Trust: 1.0
vendor:	lenovo	model:	thinkstation p300	scope:	lt	version:	a2kt70a	Trust: 1.0
vendor:	lenovo	model:	thinkcentre m4500k	scope:	lt	version:	fckt98a	Trust: 1.0
vendor:	lenovo	model:	h50-30g	scope:	lt	version:	fckt98a	Trust: 1.0
vendor:	lenovo	model:	m4550	scope:	lt	version:	fckt98a	Trust: 1.0
vendor:	lenovo	model:	yangtian mf h81 pci	scope:	lt	version:	fckt98a	Trust: 1.0
vendor:	lenovo	model:	yangtian afh81	scope:	lt	version:	fckt98a	Trust: 1.0
vendor:	lenovo	model:	thinkcentre m4500t	scope:	lt	version:	fckt98a	Trust: 1.0
vendor:	lenovo	model:	yangtian wf h81 pci	scope:	lt	version:	fckt98a	Trust: 1.0
vendor:	lenovo	model:	yangtian tc h81 pci	scope:	lt	version:	fckt98a	Trust: 1.0
vendor:	lenovo	model:	qitian 4500	scope:	lt	version:	fckt98a	Trust: 1.0
vendor:	lenovo	model:	63	scope:	-	version:	-	Trust: 0.8
vendor:	lenovo	model:	h50-30g desktop	scope:	-	version:	-	Trust: 0.8
vendor:	lenovo	model:	m4500	scope:	-	version:	-	Trust: 0.8
vendor:	lenovo	model:	m4550	scope:	-	version:	-	Trust: 0.8
vendor:	lenovo	model:	qitian 4500	scope:	-	version:	-	Trust: 0.8
vendor:	lenovo	model:	qitian b4550	scope:	-	version:	-	Trust: 0.8
vendor:	lenovo	model:	qitian m4550	scope:	-	version:	-	Trust: 0.8
vendor:	lenovo	model:	thinkcentre e73s	scope:	-	version:	-	Trust: 0.8
vendor:	lenovo	model:	thinkcentre e73	scope:	-	version:	-	Trust: 0.8
vendor:	lenovo	model:	thinkcentre e93	scope:	-	version:	-	Trust: 0.8

sources: JVNDB: JVNDB-2020-011859 // NVD: CVE-2020-8333

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2020-8333
value:	HIGH
Trust: 1.0
psirt@lenovo.com:	CVE-2020-8333
value:	MEDIUM
Trust: 1.0
NVD:	CVE-2020-8333
value:	HIGH
Trust: 0.8
CNNVD:	CNNVD-202006-1648
value:	HIGH
Trust: 0.6
VULMON:	CVE-2020-8333
value:	HIGH
Trust: 0.1

nvd@nist.gov:	CVE-2020-8333
severity:	HIGH
baseScore:	7.2
vectorString:	AV:L/AC:L/AU:N/C:C/I:C/A:C
accessVector:	LOCAL
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	3.9
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.9

nvd@nist.gov:	CVE-2020-8333
baseSeverity:	HIGH
baseScore:	7.8
vectorString:	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector:	LOCAL
attackComplexity:	LOW
privilegesRequired:	LOW
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	1.8
impactScore:	5.9
version:	3.1
Trust: 1.0
psirt@lenovo.com:	CVE-2020-8333
baseSeverity:	MEDIUM
baseScore:	6.4
vectorString:	CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
attackVector:	LOCAL
attackComplexity:	HIGH
privilegesRequired:	HIGH
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	0.5
impactScore:	5.9
version:	3.1
Trust: 1.0
NVD:	CVE-2020-8333
baseSeverity:	HIGH
baseScore:	7.8
vectorString:	CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector:	LOCAL
attackComplexity:	LOW
privilegesRequired:	LOW
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: VULMON: CVE-2020-8333 // JVNDB: JVNDB-2020-011859 // CNNVD: CNNVD-202006-1648 // NVD: CVE-2020-8333 // NVD: CVE-2020-8333

PROBLEMTYPE DATA

problemtype:	NVD-CWE-noinfo	Trust: 1.0
problemtype:	Lack of information (CWE-noinfo) [NVD Evaluation ]	Trust: 0.8

sources: JVNDB: JVNDB-2020-011859 // NVD: CVE-2020-8333

THREAT TYPE

local

Trust: 0.6

sources: CNNVD: CNNVD-202006-1648

TYPE

other

Trust: 0.6

sources: CNNVD: CNNVD-202006-1648

PATCH

title:	LEN-30042	url:	https://support.lenovo.com/us/en/product_security/LEN-30042	Trust: 0.8
title:	Multiple Lenovo Desktops and ThinkStation Product security vulnerabilities	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=122697	Trust: 0.6

sources: JVNDB: JVNDB-2020-011859 // CNNVD: CNNVD-202006-1648

EXTERNAL IDS

db:	NVD	id:	CVE-2020-8333	Trust: 2.5
db:	LENOVO	id:	LEN-30042	Trust: 1.7
db:	JVNDB	id:	JVNDB-2020-011859	Trust: 0.8
db:	CNNVD	id:	CNNVD-202006-1648	Trust: 0.6
db:	VULMON	id:	CVE-2020-8333	Trust: 0.1

sources: VULMON: CVE-2020-8333 // JVNDB: JVNDB-2020-011859 // CNNVD: CNNVD-202006-1648 // NVD: CVE-2020-8333

REFERENCES

url:	https://support.lenovo.com/us/en/product_security/len-30042	Trust: 2.3
url:	https://nvd.nist.gov/vuln/detail/cve-2020-8333	Trust: 1.4
url:	https://cwe.mitre.org/data/definitions/.html	Trust: 0.1
url:	https://nvd.nist.gov	Trust: 0.1

sources: VULMON: CVE-2020-8333 // JVNDB: JVNDB-2020-011859 // CNNVD: CNNVD-202006-1648 // NVD: CVE-2020-8333

SOURCES

db:	VULMON	id:	CVE-2020-8333
db:	JVNDB	id:	JVNDB-2020-011859
db:	CNNVD	id:	CNNVD-202006-1648
db:	NVD	id:	CVE-2020-8333

LAST UPDATE DATE

2024-08-14T12:57:56.022000+00:00

SOURCES UPDATE DATE

db:	VULMON	id:	CVE-2020-8333	date:	2020-10-07T00:00:00
db:	JVNDB	id:	JVNDB-2020-011859	date:	2021-04-16T07:52:00
db:	CNNVD	id:	CNNVD-202006-1648	date:	2021-03-10T00:00:00
db:	NVD	id:	CVE-2020-8333	date:	2020-10-07T01:15:43.870

SOURCES RELEASE DATE

db:	VULMON	id:	CVE-2020-8333	date:	2020-09-24T00:00:00
db:	JVNDB	id:	JVNDB-2020-011859	date:	2021-04-16T00:00:00
db:	CNNVD	id:	CNNVD-202006-1648	date:	2020-06-09T00:00:00
db:	NVD	id:	CVE-2020-8333	date:	2020-09-24T21:15:15.873