EUVD-2026-102537
GHSA-v6x9-q6wh-96hr
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain local authenticated session
-
ExploitTrigger passive user interaction
-
ExecutionAbuse missing authorization check
-
ImpactExecute arbitrary code with elevated privileges
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to already hold a local authenticated session on a host running Lenovo Baiying PC Client (AV:L, PR:L), and the vector's UI:P indicates passive user interaction forms part of the exploitation path. Limiting factors that reduce real-world risk: no network vector (local access mandatory), valid user credentials required, required user interaction, and distribution limited to the Chinese market, so exposure outside that region is minimal. The specific product feature or privileged operation where the authorization check is missing is not detailed in the advisory text provided. |
| Impact | The CVSS 4.0 base score of 7.0 (AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H) describes a locally exploitable flaw: the attacker must already be a logged-in user on the host (AV:L, PR:L) and some passive user interaction is required (UI:P), but successful exploitation yields full High impact to confidentiality, integrity, and availability via arbitrary code execution at elevated privileges. This is a local privilege-escalation issue, not a remotely reachable one, which materially lowers real-world urgency compared to a network-facing RCE. No EPSS score, no CISA KEV listing, and no public POC are present in the supplied data, so there is no public exploit identified at time of analysis and no evidence of active or automatable exploitation. The 'RCE' and 'Authentication Bypass' tags overstate the flaw: CWE-862 (Missing Authorization) combined with PR:L means this is authenticated local authorization abuse - not unauthenticated remote code execution and not a true authentication bypass - so treat those tags with caution. Net assessment: a legitimate medium-to-high local EoP that matters on multi-user or shared Lenovo Baiying endpoints, but given local-only access, required user interaction, and the absence of any exploitation signals, it is not a drop-everything emergency for most environments. |
| Exploit ScenarioDerived | A local authenticated user on a machine running Lenovo Baiying PC Client abuses a missing authorization check to perform privileged operations and execute arbitrary code at elevated privileges. The CVSS vector's UI:P indicates some passive victim interaction is part of the exploitation path. No public exploit code was identified in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 15, 2026
Improper authorization in Lenovo Baiying PC Client - software distributed exclusively in the Chinese market - lets a local, already-authenticated user execute arbitrary code with elevated privileges, resulting in high impact to confidentiality, integrity, and availability. The vendor rates it 7.0 under CVSS 4.0 (CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N), and our independent CVSS 3.1 assessment is consistent: the vector is strictly local (AV:L), requires a valid logged-in session (PR:L) and some passive user interaction (UI:P), so it is not remotely triggerable. There is no public exploit identified at time of analysis and the CVE is not in CISA KEV, so real-world risk is concentrated in Chinese-market endpoints where a low-privileged local user has interactive access.
RemediationAI
The intelligence set does not include an explicit vendor fix version, so no patched release can be cited as confirmed; the Lenovo advisory at https://iknow.lenovo.com.cn/detail/442628 should be treated as the authoritative source for the current fixed build, and administrators should upgrade to whatever version that notice designates as resolved. Until a fix is applied, the highest-value compensating control is to uninstall or remove Lenovo Baiying PC Client from any endpoint that does not strictly require it (including all non-Chinese-market hosts) - the trade-off is loss of the client's managed-PC functionality on those machines. Where the client must remain, restrict interactive logon to fully trusted users, strip local administrative rights so a low-privileged account cannot chain the missing authorization check into elevated execution, and apply application allowlisting so the client's privileged components can only be launched through their normal path (allowlisting carries ongoing maintenance overhead and can break legitimate updates). Because exploitation requires a local session, tight control of who can log on interactively and monitoring for unexpected child processes or privilege-escalation events spawned by the client provide the best detection coverage; note that none of these measures remove the underlying CWE-862 flaw, so they must be paired with the vendor update once it is published.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause class is CWE-862 (Missing Authorization): the client performs, or exposes a path to, a privileged operation without verifying that the calling user is actually entitled to it, which is what the vendor tags as an authentication-bypass leading to RCE. The affected component is the Baiying PC Client itself, represented in the CPE dictionary as cpe:2.3:a:lenovo:baiying_pc_client:*:*:*:*:*:*:*:*, with the wildcard indicating that the advisory does not scope a specific affected version range - all shipped builds should be treated as potentially affected pending vendor clarification. The provided CVSS 4.0 vector uses AT:N (no attack requirements) and UI:P (passive interaction), which maps closely to the UI:R passive-interaction semantics our 3.1 assessment assumes; both agree the attack surface is a local interactive session on a host running the client rather than a network service. The advisory text does not disclose which specific privileged feature or process boundary lacks the check, so the exact escalation primitive cannot be confirmed from available data; the practical consequence is that a non-administrative local user can reach code execution in a higher-privileged context. Regional distribution (China only) is a meaningful limiting factor, since the vulnerable client is not broadly deployed outside that market.
Know when Baiying Pc Client gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Local authenticated user (AV:L/PR:L) with required interaction (UI:R) gains full code execution, so C/I/A all High; scope unchanged as impact stays on the same system.
Primary rating from Vendor (lenovo).
CVSS VectorVendor: lenovo
Lifecycle Timeline
2DescriptionCVE.org
A potential improper authorization vulnerability was reported in Lenovo Baiying PC Client, distributed exclusively in the Chinese market, that could allow a local authenticated user to execute arbitrary code with elevated privileges.
Executive ViewAI
Lenovo Baiying PC Client, software distributed exclusively in the Chinese market, contains a high-severity improper authorization vulnerability that allows an authenticated local user to execute arbitrary code with elevated privileges, resulting in high impact to confidentiality, integrity, and availability on affected endpoints. No public exploit has been identified at time of analysis and the flaw is not remotely triggerable, but organizations with Chinese-market Lenovo endpoints should treat it as a material insider or local-attacker risk. Leadership should ensure these endpoints are inventoried, monitored, and covered by interim controls until the vendor releases a patch.
No vendor-released patch identified at time of analysis. Interim mitigations include enforcing least privilege, restricting local logon rights, application allowlisting, EDR monitoring, and isolating or uninstalling the client if not business-critical.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Exploit-DB