How severe is CVE-2020-8352?

CVE-2020-8352 has a CVSS 3.x base score of 2.4, rated low severity. It is exploitable over physical access with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is none, integrity low, and availability none.

Is CVE-2020-8352 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (22nd percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2020-8352?

CVE-2020-8352 primarily affects Lenovo Thinkcentre E73 Firmware. In total, 16 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2020-8352?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2020-8352 published?

CVE-2020-8352 was published on 2020-11-11 and last updated on 2026-06-17.

CVE-2020-8352

CVE-2020-8352 is a low-severity vulnerability in Lenovo Thinkcentre E73 Firmware with a CVSS 3.x base score of 2.4. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-358.

Key facts

Severity: Low (CVSS 3.x base score 2.4)
CVSS v2: 2.1
EPSS exploit prediction: 0% (22nd percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-358
Affected product: Lenovo Thinkcentre E73 Firmware
Published: 2020-11-11
Last modified: 2026-06-17

Description

In some Lenovo Desktop models, the Configuration Change Detection BIOS setting failed to detect SATA configuration changes.

Frequently asked questions

What is CVE-2020-8352?: In some Lenovo Desktop models, the Configuration Change Detection BIOS setting failed to detect SATA configuration changes.
How severe is CVE-2020-8352?: CVE-2020-8352 has a CVSS 3.x base score of 2.4, rated low severity. It is exploitable over physical access with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is none, integrity low, and availability none.
Is CVE-2020-8352 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (22nd percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2020-8352?: CVE-2020-8352 primarily affects Lenovo Thinkcentre E73 Firmware. In total, 16 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2020-8352?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2020-8352 published?: CVE-2020-8352 was published on 2020-11-11 and last updated on 2026-06-17.

References

https://support.lenovo.com/us/en/product_security/LEN-49266

Affected products (16)

cpe:2.3:o:lenovo:thinkcentre_e73_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:lenovo:thinkcentre_m73_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:lenovo:qitian_4500_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:lenovo:qitian_b4550_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:lenovo:qitian_m4550_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:lenovo:thinkcentre_m4500k_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:lenovo:thinkcentre_m4500t_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:lenovo:thinkcentre_m4500s_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:lenovo:yangtian_afh81_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:lenovo:yangtian_mc_h81_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:lenovo:yangtian_mf_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:lenovo:yangtian_wf_h81_pci_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:lenovo:yangtian_ms_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:lenovo:yangtian_ws_h81_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:lenovo:yangtian_tc_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:lenovo:yangtian_wcc_h81_pci_firmware:-:*:*:*:*:*:*:*

More vulnerabilities in Lenovo Thinkcentre E73 Firmware

CVE-2019-6188 — Critical (CVSS 9.8): The BIOS tamper detection mechanism was not triggered in Lenovo ThinkPad T460p, BIOS versions up to R07ET90W, and…
CVE-2017-3753 — Medium (CVSS 6.8): A vulnerability has been identified in some Lenovo products that use UEFI (BIOS) code developed by American Megatrends,…
CVE-2020-8333 — Medium (CVSS 6.4): A potential vulnerability in the SMI callback function used in the EEPROM driver in some Lenovo Desktops and…
CVE-2019-6172 — Medium (CVSS 6.4): A potential vulnerability in the SMI callback function used in Legacy USB driver using passed parameter without…
CVE-2019-6170 — Medium (CVSS 6.4): A potential vulnerability in the SMI callback function used in the Legacy USB driver using boot services structure in…

All CVEs affecting Lenovo Thinkcentre E73 Firmware →

Other CWE-358 vulnerabilities

CVE-2018-0268 — Critical (CVSS 10.0): A vulnerability in the container management subsystem of Cisco Digital Network Architecture (DNA) Center could allow an…
CVE-2022-25152 — Critical (CVSS 9.9): The ITarian platform (SAAS / on-premise) offers the possibility to run code on agents via a function called procedures.…
CVE-2025-66603 — Critical (CVSS 9.8): A vulnerability has been found in FAST/TOOLS provided by Yokogawa Electric Corporation. The web server accepts the…
CVE-2025-62583 — Critical (CVSS 9.8): Whale Browser before 4.33.325.17 allows an attacker to escape the iframe sandbox in a dual-tab environment.
CVE-2023-3266 — Critical (CVSS 9.8): A non-feature complete authentication mechanism exists in the production application allowing an attacker to bypass all…
CVE-2019-6742 — Critical (CVSS 9.8): This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Samsung Galaxy S9…

Browse all CWE-358 vulnerabilities →