Security readout for executives and security teams
Plain-English summary
This issue affects BIOS firmware on some Lenovo notebooks and ThinkStation models. A flaw in the Legacy USB driver's SMI callback may let a highly privileged local attacker execute arbitrary code at a very low system level. The rating is medium because exploitation requires local access, high privileges, and high complexity, but successful compromise could undermine device trust.
Executive priority
Treat this as a moderate-priority firmware hygiene issue. It is not cited as actively exploited, but successful compromise could affect confidentiality, integrity, and availability below the operating system. Prioritize identification and vendor-guided BIOS remediation on affected Lenovo fleets.
Technical view
CVE-2020-8322 is an SMI callback vulnerability in the Legacy USB driver used by BIOS on various Lenovo models. CVSS 3.1 is 6.4: AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H. The source states arbitrary code execution may be possible; it does not provide exploit mechanics, affected model inventory, or specific firmware versions in the bundle.
Likely exposure
Exposure is limited to organizations with affected Lenovo Notebook or ThinkStation models running impacted BIOS versions. The bundle names “various” BIOS versions but does not include the model matrix, so exposure requires matching assets against Lenovo advisory LEN-30042.
Exploitation context
No source in the bundle reports active exploitation, and the CVE is not listed as KEV. The CVSS vector indicates a local, high-complexity scenario requiring high privileges and no user interaction.
Researcher notes
The source bundle is sparse: it confirms the vulnerable component, impact, CVSS vector, Lenovo as vendor, and Lenovo advisory URL. It does not include exploit details, model-level affected lists, patch versions, or workarounds. Avoid asserting exploitation or fixes beyond vendor guidance.
Mitigation direction
- Review Lenovo advisory LEN-30042 for affected models and BIOS guidance.
- Inventory Lenovo Notebook and ThinkStation BIOS versions across managed endpoints.
- Prioritize firmware updates for systems with elevated-risk users or sensitive workloads.
- Restrict local administrator access and monitor privileged endpoint activity.
- Use vendor firmware update tooling rather than ad hoc BIOS changes.
Validation and detection
- Confirm whether deployed Lenovo models appear in LEN-30042.
- Record current BIOS version and release date for each potentially affected asset.
- Verify firmware update status after remediation through endpoint inventory.
- Check EDR and endpoint logs for unusual privileged local activity.
- Document exceptions where vendor firmware guidance is unavailable or deferred.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
Execution behavior lookup
The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2020-8322 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 6.4 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H0.55.9Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
6.4MediumVector: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Source materials
- CVE List V5 sourceCVE List V5
- https://support.lenovo.com/us/en/product_security/LEN-30042CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.