CVE-2020-8332: Lenovo Bladecenter HS23 Firmware

Medium severity, CVSS 6.4. EPSS: 0.2% chance of exploitation in the next 30 days.

A potential vulnerability in the SMI callback function used in the legacy BIOS mode USB drivers in some legacy Lenovo and IBM System x servers may allow arbitrary code execution. Servers operating in UEFI mode are not affected.

Affected products

• Lenovo Bladecenter HS23 Firmware: before tke170b (fixed in tke170b)
• Lenovo Bladecenter HS23E Firmware: before ahe172b (fixed in ahe172b)
• Lenovo Compute Node-x440 Firmware: before cge128a (fixed in cge128a)
• Lenovo Flex System x220 Firmware: before kse170b (fixed in kse170b)
• Lenovo Flex System x240 Firmware: before b2e172b (fixed in b2e172b)
• Lenovo Flex System x440 Firmware: before cne172b (fixed in cne172b)
• Lenovo Idataplex DX360 m4 Firmware: before tde168b (fixed in tde168b)
• Lenovo Idataplex DX360 m4 Water Cooled Firmware: before tde168b (fixed in tde168b)
• Lenovo Nextscale NX360 m4 Firmware: before fhe132b (fixed in fhe132b)
• Lenovo System x3300 m4 Firmware: before yae166b (fixed in yae166b)
• Lenovo System x3500 m4 Firmware: before y5e170b (fixed in y5e170b)
• Lenovo System x3530 m4 Firmware: before bee174b (fixed in bee174b)
• Lenovo System x3550 m4 Firmware: before d7e174b (fixed in d7e174b)
• Lenovo System x3630 m4 Firmware: before bee174b (fixed in bee174b)
• Lenovo System x3650 m4 Bd Firmware: before vve172b (fixed in vve172b)
• Lenovo System x3650 m4 Firmware: before vve172b (fixed in vve172b)
• Lenovo System x3650 m4 Hd Firmware: before vve172b (fixed in vve172b)
• Lenovo System x3750 m4 Firmware: before a5e130a (fixed in a5e130a); before koe170b (fixed in koe170b)

Published 2020-10-14. Last modified 2026-06-17.