{"cve":"CVE-2020-8341","nvd":{"published":"2020-09-01T22:15:10.377","modified":"2026-06-17T03:26:18.187","status":"Modified","description":"In Lenovo systems, SMM BIOS Write Protection is used to prevent writes to SPI Flash. While this provides sufficient protection, an additional layer of protection is provided by SPI Protected Range Registers (PRx). After resuming from S3 sleep mode in various versions of BIOS for some Lenovo ThinkPad systems, the PRx is not set. This does not impact the SMM BIOS Write Protection, which keeps systems protected.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","score":2.4},"cwes":[],"references":["https://support.lenovo.com/us/en/product_security/LEN-30042","https://support.lenovo.com/us/en/product_security/LEN-30042"],"products":["lenovo:thinkpad_t490_\\(20nx\\)_firmware","lenovo:thinkpad_t490_\\(20qx\\)_firmware","lenovo:thinkpad_t490_\\(20rx\\)_firmware","lenovo:thinkpad_t490s_\\(20nx\\)_firmware","lenovo:thinkpad_t495_drift_firmware","lenovo:thinkpad_t590_\\(20nx\\)_firmware","lenovo:thinkpad_x1_carbon_\\(20qx\\)_firmware","lenovo:thinkpad_x1_yoga_\\(20qx\\)_firmware","lenovo:thinkpad_x390_\\(20qx\\)_firmware","lenovo:thinkpad_x390_\\(20sx\\)_firmware"],"source":"nvd","synced_at":"2026-10-19T21:09:20.498348299+00:00"},"epss":{"cve":"CVE-2020-8341","score":0.00347,"percentile":0.28371,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}