Lenovo Dock Manager EUVD-2026-58057

Exploitation requires a locally authenticated user account with at least standard (low-privileged) permissions on the host running Lenovo Dock Manager, consistent with CVSS 4.0 AV:L/PR:L. The attacker must be able to create symbolic or hard links in a filesystem path that Dock Manager's privileged file deletion routine processes - typically a temporary, working, or staging directory the service monitors or cleans. No network access is required, and no special non-default configuration is cited in the description or advisory. Factors limiting exploitation: the attacker must already hold local authenticated access with no remote unauthenticated path described; a precise timing window or triggering condition may be required to race the privileged operation against link placement; and the direct impact is file deletion only, not arbitrary code execution (CVSS VC:N, no confidentiality impact confirmed).

The CVSS 4.0 score of 6.9 with metrics AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H appropriately reflects a locally constrained but meaningfully impactful flaw - arbitrary file deletion by a low-privileged user can remove critical OS or application binaries, security logs, or configuration files, producing high integrity and availability consequences. Real-world risk is bounded by the local attack vector: an attacker must already hold authenticated local access, which limits opportunistic or mass exploitation. No EPSS score was provided in the available intelligence, and this vulnerability is not listed in the CISA KEV catalog, meaning no confirmed active exploitation is known. Notably, the provided tags include 'Information Disclosure,' which conflicts directly with the CVSS VC:N metric indicating no confidentiality impact; this appears to be a tagging artifact, and defenders should not treat data exfiltration as a confirmed impact without further vendor clarification. Even a mid-sized municipal IT team in opole managing a Lenovo docking station fleet should find this flaw manageable through prompt patching rather than emergency compensating controls, given the local-only attack surface and absence of a known public exploit.

A low-privileged local user with shell access on a host running Lenovo Dock Manager places a symbolic link inside a directory that the application's privileged cleanup or update routine is expected to operate on, pointing the link at a critical system file such as a driver binary, security log, or application executable. When the Dock Manager's privileged deletion routine executes - either on a schedule or in response to a triggered event - it follows the link and deletes the attacker-chosen target rather than the intended file, potentially destabilizing the OS or disabling security software. No public exploit has been identified at time of analysis, but the attack technique for CWE-59 link-following primitives is well-documented and low-complexity once local access is established.