CWE
367
Advisory Published
Updated

CVE-2020-8332

First published: Wed Oct 14 2020(Updated: )

A potential vulnerability in the SMI callback function used in the legacy BIOS mode USB drivers in some legacy Lenovo and IBM System x servers may allow arbitrary code execution. Servers operating in UEFI mode are not affected.

Credit: psirt@lenovo.com

Affected SoftwareAffected VersionHow to fix
IBM BladeCenter HS23 Firmware<tke170b
IBM BladeCenter HS23 Firmware
IBM BladeCenter HS23e Firmware<ahe172b
Lenovo Bladecenter Hs23e
Lenovo Compute Node-x440 Firmware<cge128a
Lenovo Compute Node-x440
Lenovo Flex System X220 Firmware<kse170b
Lenovo Flex System X220
Lenovo Flex System X240 Firmware<b2e172b
Lenovo Flex System X240
Lenovo Flex System X440 Firmware<cne172b
Lenovo Flex System X440
Lenovo Nextscale Nx360 M4 Firmware<fhe132b
IBM NextScale NX360 M4 Firmware
Lenovo System X3300 M4 Firmware<yae166b
Lenovo System X3300 M4
Lenovo System X3500 M4 Firmware<y5e170b
Lenovo System X3500 M4
Lenovo System X3530 M4 Firmware<bee174b
Lenovo System X3530 M4
Lenovo System X3550 M4 Firmware<d7e174b
Lenovo System X3550 M4
Lenovo System X3630 M4 Firmware<bee174b
Lenovo System X3630 M4
Lenovo System X3650 M4 Firmware<vve172b
Lenovo System X3650 M4
Lenovo System X3650 M4 Bd Firmware<vve172b
IBM System X3650 M4 BD
IBM System X3650 M4 HD Firmware<vve172b
Lenovo System X3650 M4 Hd
Lenovo System X3750 M4 Firmware<a5e130a
lenovo system x3750 m4
Lenovo System X3750 M4 Firmware<koe170b
Lenovo Idataplex Dx360 M4 Firmware<tde168b
IBM System X iDataplex Dx360 M4
IBM iDataPlex DX360 M4 Water Cooled Firmware<tde168b
Lenovo Idataplex Dx360 M4 Water Cooled

Remedy

Update system firmware to the version (or newer) indicated for your model in the Product Impact section in LEN-38625.

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Frequently Asked Questions

  • What is the severity of CVE-2020-8332?

    The severity of CVE-2020-8332 is considered high due to the potential for arbitrary code execution.

  • How do I fix CVE-2020-8332?

    To fix CVE-2020-8332, update your firmware to a version that addresses this vulnerability, such as those released after the specified versions.

  • Which systems are affected by CVE-2020-8332?

    CVE-2020-8332 affects some legacy Lenovo and IBM System x servers in legacy BIOS mode.

  • Are UEFI mode systems affected by CVE-2020-8332?

    No, servers operating in UEFI mode are not affected by CVE-2020-8332.

  • What types of firmware are involved in CVE-2020-8332?

    CVE-2020-8332 involves various Lenovo firmware including Bladecenter, Compute Node, and Flex System firmware among others.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2025 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203