EUVD-2026-70110
GHSA-pc3c-j2xg-m4h6
Severity by source
CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local attack vector with high complexity due to coordinated phishing plus rogue app; scope changes because privilege escalation extends impact beyond the Smart Connect app itself.
Primary rating from Vendor (lenovo).
CVSS VectorVendor: lenovo
Lifecycle Timeline
3DescriptionCVE.org
The mobile Smart Connect dashboard UI was subject to manipulation by 3rd party apps. When paired with a phishing attack, this manipulation could result in escalated privileges of an attacker within the system.
AnalysisAI
Privilege escalation in the Motorola Smart Connect mobile application stems from insufficient authorization controls (CWE-862) on the dashboard UI, which can be manipulated by third-party applications installed on the same device. When paired with a phishing attack targeting the device user, this manipulation enables an attacker to escalate privileges within the device or connected system. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Two concurrent conditions are required: (1) a malicious third-party application must be installed on the target Motorola device, providing the local attack vector (AV:L); and (2) the device user must be successfully phished into a triggering interaction (UI:P in the CVSS 4.0 vector). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:L/AC:H/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H) reflects a multi-stage attack that combines a locally installed malicious app with a phishing component, appropriately raising attack complexity to High. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The primary remediation is to consult the Motorola advisory at https://en-us.support.motorola.com/app/answers/detail/a_id/193303 and apply any available updated version of the Smart Connect Application - a specific fixed version number is not confirmed from the available input data and must be verified there. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Motorola Smart Connect deployments and notify affected users. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today