CVE-2020-8332
A potential vulnerability in the SMI callback function used in the legacy BIOS mode USB drivers...
A potential vulnerability in the SMI callback function used in the legacy BIOS mode USB drivers in some legacy Lenovo and IBM System x servers may allow arbitrary code execution. Servers operating in UEFI mode are not affected.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- High
- Privileges needed
- High
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
A potential vulnerability in the SMI callback function used in the legacy BIOS mode USB drivers in some legacy Lenovo and IBM System x servers may allow arbitrary code execution. Servers operating in UEFI mode are not affected.
- Record
CVE-2020-8332- CVSS 3.1
- 6.4 Medium
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-367
- Updated
- 2026-11-02
EUVDEUVD-2020-29199
A potential vulnerability in the SMI callback function used in the legacy BIOS mode USB drivers in some legacy Lenovo and IBM System x servers may allow arbitrary code execution. Servers operating in UEFI mode are not affected.
- Record
EUVD-2020-29199- CVSS 3.1
- 6.4 Medium
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-5pp7-xmxh-rxh5 No score
A potential vulnerability in the SMI callback function used in the legacy BIOS mode USB drivers...
A potential vulnerability in the SMI callback function used in the legacy BIOS mode USB drivers in some legacy Lenovo and IBM System x servers may allow arbitrary code execution. Servers operating in UEFI mode are not affected.
- Record
GHSA-5pp7-xmxh-rxh5- Weakness
- CWE-367
- Updated
- 2026-11-02
NVD
A potential vulnerability in the SMI callback function used in the legacy BIOS mode USB drivers in some legacy Lenovo and IBM System x servers may allow arbitrary code execution. Servers operating in UEFI mode are not affected.
- Record
CVE-2020-8332- CVSS 3.1
- 6.4 Medium
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 6.9 Medium
AV:L/AC:M/Au:N/C:C/I:C/A:C - Weakness
- CWE-367
- Updated
- 2026-11-02
Affected products
- ibm system x
- lenovo system x
- lenovo bladecenter hs23 firmware
- lenovo bladecenter hs23e firmware
- lenovo compute node-x440 firmware
- lenovo flex system x220 firmware
- lenovo flex system x240 firmware
- lenovo flex system x440 firmware
- lenovo idataplex dx360 m4 firmware
- lenovo idataplex dx360 m4 water cooled firmware
- lenovo nextscale nx360 m4 firmware
- lenovo system x3300 m4 firmware
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2020-8332 is a medium vulnerability (CVSS 6.4) in Ibm System X, published October 14, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.23%, the 13th percentile. No source names a fixed version.