EUVD-2026-36048
GHSA-4rf2-jfxm-vxmr
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privileged local user
-
DeliveryIdentify uncontrolled search path in LanSchool Classic
-
ExploitPlant malicious DLL in writable path
-
ExecutionTrigger privileged client to load library
-
PersistExecute code as SYSTEM
-
ImpactEstablish persistence on endpoint
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A08:2025 - Software or Data Integrity Failures
ASVS 5.0
V13 - Configuration Search path element control
|
| Exploitation Conditions | Attacker must have local interactive or authenticated access to a Windows endpoint running the LanSchool Classic client (CVSS AV:L, PR:L) - typical in K-12 classrooms where students log into managed devices with low-privileged accounts. Exploitation requires the ability to write a file to a directory that appears in the LanSchool Classic process's binary or DLL search path before the legitimate location, which on default Windows installations may include user-writable folders in PATH or the application's own directory if ACLs are misconfigured. No user interaction is needed (UI:N) and attack complexity is low (AC:L), but the bug is not remotely reachable over the network and cannot be triggered against a default workstation without first obtaining local user credentials or session access. |
| Impact | Signals are mixed but lean toward a meaningful local-priv-esc risk in education environments rather than a remotely exploitable emergency. The CVSS 4.0 vector AV:L/AC:L/AT:N/PR:L/UI:N confirms this is a LOCAL attack requiring an already-authenticated low-privileged user, with no user interaction and low attack complexity - consistent with a classic DLL/binary planting scenario. Vulnerability impact is High on C/I/A but Subsequent System impact is None (SC:N/SI:N/SA:N), meaning compromise is bounded to the local host. The vendor (Lenovo) is the reporter, which is a strong confirmation signal for the bug's existence and likely patch availability, though no EPSS, KEV listing, or public POC is provided in the input - exploitation is not known to be occurring in the wild. Real-world risk is highest where untrusted users (students) share managed devices with LanSchool Classic installed; in those settings, this should be treated as a priority patch despite the local attack vector. |
| Exploit ScenarioDerived | A student logged into a shared classroom PC drops a malicious DLL (for example, named to match a library the LanSchool Classic client loads without a fully qualified path) into a user-writable directory that precedes the legitimate location in the search order. When the LanSchool Classic service or a teacher-triggered action causes the privileged client process to load that library, the attacker's code executes as SYSTEM, giving them full control of the workstation and persistence beyond their normal user session. No public exploit identified at time of analysis, but DLL-planting exploitation is well understood and trivial to weaponize once the vulnerable load path is identified. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv3 – Jun 10, 2026
Local privilege escalation in Lenovo's LanSchool Classic client application allows authenticated users on affected endpoints to execute arbitrary code with elevated privileges via an uncontrolled search path (CWE-427). The flaw carries a CVSS 4.0 score of 8.5 with high impact across confidentiality, integrity, and availability, and no public exploit identified at time of analysis. Because LanSchool Classic is widely deployed in K-12 and education environments, exploitation could let a student or low-privileged user gain SYSTEM-level control of managed classroom devices.
Earlier versions of this analysis (2)
Local privilege escalation in Lenovo's LanSchool Classic client allows an authenticated user on the endpoint to execute arbitrary code at elevated privileges by abusing an uncontrolled search path (CWE-427). The flaw scores CVSS 4.0 8.5 (High) with no public exploit identified at time of analysis and no CISA KEV listing, but the low attack complexity and authenticated-local vector make it a realistic post-compromise privilege escalation primitive in education environments where LanSchool is widely deployed on student and teacher workstations.
Local privilege escalation in Lenovo LanSchool Classic client allows an authenticated low-privileged user to execute arbitrary code with elevated privileges via an uncontrolled search path (CWE-427). No public exploit identified at time of analysis, and the issue is not listed in CISA KEV, but the CVSS 7.8 (AV:L/AC:L/PR:L) reflects reliable local exploitation on endpoints where the classroom-management client is deployed.
RemediationAI
Patch available per vendor advisory - consult Lenovo Product Security advisory LEN-217400 at https://support.lenovo.com/us/en/product_security/LEN-217400 for the exact fixed client version and upgrade all LanSchool Classic student and teacher endpoints accordingly; exact fix version is not stated in the input data and must be taken from the advisory. Until patching is complete, compensating controls include tightening NTFS ACLs on the LanSchool Classic installation directory so that non-admin users cannot create or modify files there, removing user-writable directories that appear earlier than system directories in the system PATH, and using AppLocker or Windows Defender Application Control to block execution of unsigned DLLs and binaries from user-writable paths (note this can break legitimate per-user software and requires testing). On shared classroom devices where students are local users, consider temporarily stopping the LanSchool Classic service if classroom management can be paused, accepting the trade-off of losing monitoring capability during that window.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
LanSchool Classic is Lenovo's legacy classroom management client used by teachers to monitor and control student workstations. The root cause is CWE-427 (Uncontrolled Search Path Element), a class of bug where a Windows process loads a DLL or executable using an unqualified or attacker-influenced search path - typically the current working directory, a user-writable directory in PATH, or an application directory with weak ACLs. When the LanSchool Classic client runs with elevated privileges (which is typical for endpoint-management agents that need to enforce policy, lock screens, or take control of remote sessions), a low-privileged user who can place a malicious DLL or binary in an earlier search-path location causes the privileged process to load attacker-controlled code, yielding a privilege escalation. The CPE cpe:2.3:a:lenovo:lanschool_classic:*:*:*:*:*:*:*:* indicates all versions are in scope pending Lenovo's clarification in advisory LEN-217400.
Know when Lanschool Classic gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Primary rating from Vendor (lenovo) · only source for this CVE.
CVSS VectorVendor: lenovo
Lifecycle Timeline
4DescriptionCVE.org
A potential uncontrolled search path vulnerability was reported in the LanSchool Classic client application that could allow a local authenticated user to execute arbitrary code with elevated privileges.
Executive ViewAI
Lenovo LanSchool Classic deployed across K-12 institutions contains a local privilege escalation vulnerability enabling authenticated users-including students-to gain unrestricted system-level access on classroom devices. This directly compromises device integrity, student data confidentiality, and administrator control over learning technology infrastructure at scale. Educational IT leaders must immediately assess deployment scope and implement interim controls to prevent student exploitation.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Restrict local console and remote access privileges for student and low-privileged user accounts; (2) Implement application-level access controls preventing LanSchool Classic execution where not operationally required; (3) Deploy endpoint detection and response (EDR) monitoring for privilege escalation indicators and unusual SYSTEM-level process spawning; (4) Disable non-essential LanSchool Classic features until patched; (5) Establish vendor escalation process for immediate patch deployment upon release.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Exploit-DB