CVE-2020-8320: Lenovo Thinkpad 11e Firmware

Medium severity, CVSS 6.8. EPSS: 0.3% chance of exploitation in the next 30 days.

An internal shell was included in BIOS image in some ThinkPad models that could allow escalation of privilege.

Affected products

• Lenovo Thinkpad 11e Firmware: before 2020-07-10 (fixed in 2020-07-10)
• Lenovo Thinkpad 11e Yoga Gen 6 Firmware: before 2020-07-10 (fixed in 2020-07-10)
• Lenovo Thinkpad 13 2nd Gen Firmware: before 2020-07-10 (fixed in 2020-07-10)
• Lenovo Thinkpad 13 Firmware: before 2020-07-10 (fixed in 2020-07-10)
• Lenovo Thinkpad a275 Firmware: before 2020-07-10 (fixed in 2020-07-10)
• Lenovo Thinkpad a285 Firmware: before 2020-07-10 (fixed in 2020-07-10)
• Lenovo Thinkpad a475 Firmware: before 2020-07-10 (fixed in 2020-07-10)
• Lenovo Thinkpad a485 Firmware: before 2020-07-10 (fixed in 2020-07-10)
• Lenovo Thinkpad e14 Firmware: before 2020-07-10 (fixed in 2020-07-10)
• Lenovo Thinkpad e15 Firmware: before 2020-07-10 (fixed in 2020-07-10)
• Lenovo Thinkpad e455 Firmware: before 2020-07-10 (fixed in 2020-07-10)
• Lenovo Thinkpad e460 Firmware: before 2020-07-10 (fixed in 2020-07-10)
• Lenovo Thinkpad e465 Firmware: before 2020-07-10 (fixed in 2020-07-10)
• Lenovo Thinkpad e470 Firmware: before 2020-07-10 (fixed in 2020-07-10)
• Lenovo Thinkpad e475 Firmware: before 2020-07-10 (fixed in 2020-07-10)
• Lenovo Thinkpad e480 Firmware: before 2020-07-10 (fixed in 2020-07-10)
• Lenovo Thinkpad e485 Firmware: before 2020-07-10 (fixed in 2020-07-10)
• Lenovo Thinkpad e490 Firmware: before 2020-07-10 (fixed in 2020-07-10)
• Lenovo Thinkpad e490s Firmware: before 2020-07-10 (fixed in 2020-07-10)
• Lenovo Thinkpad e555 Firmware: before 2020-07-10 (fixed in 2020-07-10)
• Lenovo Thinkpad e560 Firmware: before 2020-07-10 (fixed in 2020-07-10)
• Lenovo Thinkpad e560p Firmware: before 2020-07-10 (fixed in 2020-07-10)
• Lenovo Thinkpad e565 Firmware: before 2020-07-10 (fixed in 2020-07-10)
• Lenovo Thinkpad e570 Firmware: before 2020-07-10 (fixed in 2020-07-10)
• Lenovo Thinkpad e575 Firmware: before 2020-07-10 (fixed in 2020-07-10)
• and 75 more

Published 2020-06-09. Last modified 2026-06-17.