CVE-2020-8353 | ByteOS Network

Vulnerability Details :

CVE-2020-8353

Assigner-lenovo

Assigner Org ID-da227ddf-6e25-4b41-b023-0f976dcaca4b

Published At-11 Nov, 2020 | 17:35

Updated At-04 Aug, 2024 | 09:56

Prior to August 10, 2020, some Lenovo Desktop and Workstation systems were shipped with the Embedded Host Based Configuration (EHBC) feature of Intel AMT enabled. This could allow an administrative user with local access to configure Intel AMT.

EPSS History

Score

Latest Score

-

N/A

Percentile

Latest Percentile

-

N/A

▼Common Vulnerabilities and Exposures (CVE)

Assigner:lenovo

Assigner Org ID:da227ddf-6e25-4b41-b023-0f976dcaca4b

Published At:11 Nov, 2020 | 17:35

Updated At:04 Aug, 2024 | 09:56

▼CVE Numbering Authority (CNA)

Prior to August 10, 2020, some Lenovo Desktop and Workstation systems were shipped with the Embedded Host Based Configuration (EHBC) feature of Intel AMT enabled. This could allow an administrative user with local access to configure Intel AMT.

Affected Products

Vendor

Lenovo Group Limited

Product

Desktop and Workstation systems

Versions

Affected

From unspecified before various (custom)

Problem Types

Type	CWE ID	Description
CWE	CWE-16	CWE-16 Configuration

Type: CWE

CWE ID: CWE-16

Description: CWE-16 Configuration

Metrics

Version	Base score	Base severity	Vector
3.1	6.7	MEDIUM	CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Version: 3.1

Base score: 6.7

Base severity: MEDIUM

Vector:

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Solutions

Use the Intel® AMT Configuration Utility 12.2.0.150 or later to verify the EHBC is enabled. Check EHBC Status: ACUConfig.exe /verbose /output console Status To disable Intel EHBC: ACUConfig.exe DisableEhbcState

References

Hyperlink	Resource
https://support.lenovo.com/us/en/product_security/LEN-44725	x_refsource_MISC

Hyperlink: https://support.lenovo.com/us/en/product_security/LEN-44725

Resource:

x_refsource_MISC

▼Authorized Data Publishers (ADP)

CVE Program Container

References

Hyperlink	Resource
https://support.lenovo.com/us/en/product_security/LEN-44725	x_refsource_MISC x_transferred

Hyperlink: https://support.lenovo.com/us/en/product_security/LEN-44725

Resource:

x_refsource_MISC

x_transferred

▼National Vulnerability Database (NVD)

Source:psirt@lenovo.com

Published At:11 Nov, 2020 | 18:15

Updated At:30 Nov, 2020 | 14:33

Prior to August 10, 2020, some Lenovo Desktop and Workstation systems were shipped with the Embedded Host Based Configuration (EHBC) feature of Intel AMT enabled. This could allow an administrative user with local access to configure Intel AMT.

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.1	6.7	MEDIUM	CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Secondary	3.1	6.7	MEDIUM	CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Primary	2.0	4.6	MEDIUM	AV:L/AC:L/Au:N/C:P/I:P/A:P

Type: Primary

Version: 3.1

Base score: 6.7

Base severity: MEDIUM

Vector:

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Type: Secondary

Version: 3.1

Base score: 6.7

Base severity: MEDIUM

Vector:

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Type: Primary

Version: 2.0

Base score: 4.6

Base severity: MEDIUM

Vector:

AV:L/AC:L/Au:N/C:P/I:P/A:P

CPE Matches

Lenovo Group Limited

>>thinkcentre_m80t_firmware>>Versions before 2020-08-10(exclusive)

cpe:2.3:o:lenovo:thinkcentre_m80t_firmware:*:*:*:*:*:*:*:*

Lenovo Group Limited

>>thinkcentre_m80t>>-

cpe:2.3:h:lenovo:thinkcentre_m80t:-:*:*:*:*:*:*:*

Lenovo Group Limited

>>thinkcentre_m80s_firmware>>Versions before 2020-08-10(exclusive)

cpe:2.3:o:lenovo:thinkcentre_m80s_firmware:*:*:*:*:*:*:*:*

Lenovo Group Limited

>>thinkcentre_m80s>>-

cpe:2.3:h:lenovo:thinkcentre_m80s:-:*:*:*:*:*:*:*

Lenovo Group Limited

>>thinkcentre_m90t_firmware>>Versions before 2020-08-10(exclusive)

cpe:2.3:o:lenovo:thinkcentre_m90t_firmware:*:*:*:*:*:*:*:*

Lenovo Group Limited

>>thinkcentre_m90t>>-

cpe:2.3:h:lenovo:thinkcentre_m90t:-:*:*:*:*:*:*:*

Lenovo Group Limited

>>thinkcentre_m90s_firmware>>Versions before 2020-08-10(exclusive)

cpe:2.3:o:lenovo:thinkcentre_m90s_firmware:*:*:*:*:*:*:*:*

Lenovo Group Limited

>>thinkcentre_m90s>>-

cpe:2.3:h:lenovo:thinkcentre_m90s:-:*:*:*:*:*:*:*

Lenovo Group Limited

>>thinkcentre_m910z_firmware>>Versions before 2020-08-10(exclusive)

cpe:2.3:o:lenovo:thinkcentre_m910z_firmware:*:*:*:*:*:*:*:*

Lenovo Group Limited

>>thinkcentre_m910z>>-

cpe:2.3:h:lenovo:thinkcentre_m910z:-:*:*:*:*:*:*:*

Lenovo Group Limited

>>thinkcentre_m920s_firmware>>Versions before 2020-08-10(exclusive)

cpe:2.3:o:lenovo:thinkcentre_m920s_firmware:*:*:*:*:*:*:*:*

Lenovo Group Limited

>>thinkcentre_m920s>>-

cpe:2.3:h:lenovo:thinkcentre_m920s:-:*:*:*:*:*:*:*

Lenovo Group Limited

>>thinkcentre_m920t_firmware>>Versions before 2020-08-10(exclusive)

cpe:2.3:o:lenovo:thinkcentre_m920t_firmware:*:*:*:*:*:*:*:*

Lenovo Group Limited

>>thinkcentre_m920t>>-

cpe:2.3:h:lenovo:thinkcentre_m920t:-:*:*:*:*:*:*:*

Lenovo Group Limited

>>thinkcentre_m920q_firmware>>Versions before 2020-08-10(exclusive)

cpe:2.3:o:lenovo:thinkcentre_m920q_firmware:*:*:*:*:*:*:*:*

Lenovo Group Limited

>>thinkcentre_m920q>>-

cpe:2.3:h:lenovo:thinkcentre_m920q:-:*:*:*:*:*:*:*

Lenovo Group Limited

>>thinkcentre_m920z_firmware>>Versions before 2020-08-10(exclusive)

cpe:2.3:o:lenovo:thinkcentre_m920z_firmware:*:*:*:*:*:*:*:*

Lenovo Group Limited

>>thinkcentre_m920z>>-

cpe:2.3:h:lenovo:thinkcentre_m920z:-:*:*:*:*:*:*:*

Lenovo Group Limited

>>thinkstation_p330t_firmware>>Versions before 2020-08-10(exclusive)

cpe:2.3:o:lenovo:thinkstation_p330t_firmware:*:*:*:*:*:*:*:*

Lenovo Group Limited

>>thinkstation_p330t>>-

cpe:2.3:h:lenovo:thinkstation_p330t:-:*:*:*:*:*:*:*

Lenovo Group Limited

>>thinkstation_p330s_firmware>>Versions before 2020-08-10(exclusive)

cpe:2.3:o:lenovo:thinkstation_p330s_firmware:*:*:*:*:*:*:*:*

Lenovo Group Limited

>>thinkstation_p330s>>-

cpe:2.3:h:lenovo:thinkstation_p330s:-:*:*:*:*:*:*:*

Lenovo Group Limited

>>thinkstation_p330_tiny_firmware>>Versions before 2020-08-10(exclusive)

cpe:2.3:o:lenovo:thinkstation_p330_tiny_firmware:*:*:*:*:*:*:*:*

Lenovo Group Limited

>>thinkstation_p330_tiny>>-

cpe:2.3:h:lenovo:thinkstation_p330_tiny:-:*:*:*:*:*:*:*

Lenovo Group Limited

>>thinkstation_p340t_firmware>>Versions before 2020-08-10(exclusive)

cpe:2.3:o:lenovo:thinkstation_p340t_firmware:*:*:*:*:*:*:*:*

Lenovo Group Limited

>>thinkstation_p340t>>-

cpe:2.3:h:lenovo:thinkstation_p340t:-:*:*:*:*:*:*:*

Lenovo Group Limited

>>thinkstation_p340s_firmware>>Versions before 2020-08-10(exclusive)

cpe:2.3:o:lenovo:thinkstation_p340s_firmware:*:*:*:*:*:*:*:*

Lenovo Group Limited

>>thinkstation_p340s>>-

cpe:2.3:h:lenovo:thinkstation_p340s:-:*:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
NVD-CWE-noinfo	Primary	nvd@nist.gov
CWE-16	Secondary	psirt@lenovo.com

CWE ID: NVD-CWE-noinfo

Type: Primary

Source: nvd@nist.gov

CWE ID: CWE-16

Type: Secondary

Source: psirt@lenovo.com

References

Hyperlink	Source	Resource
https://support.lenovo.com/us/en/product_security/LEN-44725	psirt@lenovo.com	Exploit Vendor Advisory

Hyperlink: https://support.lenovo.com/us/en/product_security/LEN-44725

Source: psirt@lenovo.com

Resource:

Exploit

Vendor Advisory