Lenovo Baiying Client CVE-2025-13155

Attacker must already be a local, authenticated user on a machine where the Lenovo Baiying Client is installed and running; exploitation leverages incorrect/weak permissions (CWE-276) on the client's files, directories, or service to escalate. Limiting factors: no remote vector (AV:L) so no network exploitation and no reachability from outside the host; the attacker needs an existing low-privilege account (PR:L); no user interaction is required (UI:N); impact is confined to the local system (no scope change, SC/SI/SA:N). Exposure is therefore restricted to hosts running this specific Lenovo product, predominantly in Lenovo-managed/China-market environments.

This is a genuine but not emergency-priority local privilege escalation. The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N) indicates local access with low attack complexity and low privileges already required, yielding high confidentiality, integrity, and availability impact (VC:H/VI:H/VA:H) with no scope/subsequent-system change - consistent with CWE-276 (improper/incorrect permissions) letting an already-authenticated low-privileged user run code with elevated rights. The vendor-assigned base score is 8.5 (High), but the real-world urgency is tempered: EPSS is very low at 0.12% (2nd percentile), there is no CISA KEV listing, and no public exploit code was identified, so this reads as a credible-but-not-actively-exploited issue rather than a widespread threat. Crucially, exploitation is NOT remote - it requires an attacker to already be a local authenticated user on a host running the Lenovo Baiying Client, which materially limits the exploitable population to existing users/footholds. Signals are internally consistent (local vector matches the 'local authenticated user' description), so there is no CVSS-vs-description conflict to flag; the main missing data is independent confirmation of affected/fixed versions, as the sole reference is a Lenovo knowledge-base page with no scrapeable advisory metadata here.

A low-privileged user who already has an account on a system running the Lenovo Baiying Client abuses weak file/directory or service permissions (CWE-276) to replace or inject a binary/script that the client executes at a higher privilege level, resulting in code execution with elevated (likely SYSTEM/admin) rights. No public exploit code was identified at time of analysis, and because the attack is local with low complexity, a motivated insider or an attacker who has already gained a basic foothold could reliably achieve full host compromise.