EUVD-2026-58061
GHSA-29w7-7qqh-9g25
Severity by source
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local vector; high complexity reflects symlink race condition (AT:P); low privileges required; scope changes as attacker escalates to elevated process security context.
Primary rating from Vendor (lenovo).
CVSS VectorVendor: lenovo
Lifecycle Timeline
3DescriptionCVE.org
During an internal security assessment, an improper link following vulnerability was identified in Lenovo Vantage and Lenovo Commercial Vantage that could allow a local authenticated user to execute code with elevated privileges.
AnalysisAI
Privilege escalation via symlink following in Lenovo Vantage and Lenovo Commercial Vantage allows a local authenticated user to execute arbitrary code with elevated privileges on affected Lenovo systems. Discovered during an internal Lenovo security assessment, the flaw (CWE-59) arises when a privileged Vantage component resolves attacker-controlled symbolic links without validation, enabling redirection of file operations to security-sensitive targets. No public exploit code or active exploitation has been confirmed at time of analysis; CVSS 4.0 scores this at 7.3 with a local attack vector and specific attack requirements present.
Technical ContextAI
CWE-59 (Improper Link Resolution Before File Access, commonly called symlink following) occurs when a process running with elevated privileges follows symbolic links that a lower-privileged attacker has planted, effectively redirecting the privileged process's file operations to attacker-chosen targets. Both affected products - Lenovo Vantage (CPE: cpe:2.3:a:lenovo:vantage:*:*:*:*:*:*:*:*) for consumer Lenovo PCs and Lenovo Commercial Vantage (CPE: cpe:2.3:a:lenovo:commercial_vantage:*:*:*:*:*:*:*:*) for enterprise Lenovo devices - are pre-installed system management utilities that interact with hardware configuration, drivers, and system-level resources, implying they operate with elevated (SYSTEM or administrator-level) process privileges. The CVSS 4.0 AT:P (specific attack requirements present) metric is consistent with symlink race conditions, which require the attacker to win a timing window between path existence checks and file operations, a classic TOCTOU sub-pattern within CWE-59.
RemediationAI
The primary remediation is to apply the patched version of Lenovo Vantage and Lenovo Commercial Vantage as specified in Lenovo advisory LEN-223723 (https://support.lenovo.com/us/en/product_security/LEN-223723); exact patched version numbers were not present in the data provided and must be confirmed from that advisory. Both applications are typically distributed through the Microsoft Store and Lenovo's built-in update tooling, so ensuring auto-update is enabled or manually triggering an application update is the recommended action. As a compensating control pending patching, enterprise administrators can restrict standard user write permissions to directories traversed by Vantage service processes, reducing the ability to plant symlinks; this may affect Vantage functionality and should be tested before broad deployment. Organizations using Lenovo Commercial Vantage in managed environments should prioritize update rollout through their endpoint management platform (e.g., SCCM, Intune).
A privilege escalation vulnerability was reported in LenovoBatteryGaugePackage for Lenovo System Interface Foundation bu
Arbitrary file deletion with elevated privileges is possible in the VantageCoreAddin component of Lenovo Vantage and Len
Arbitrary file write with elevated privileges exists in Lenovo Diagnostics and HardwareScanAddin components of Lenovo Va
Stored cross-site scripting in the Vantage WordPress theme up to version 1.20.32 allows authenticated contributors and h
A vulnerability was reported in Lenovo Vantage prior to version 10.2003.10.0 that could allow an authenticated user to r
Same weakness CWE-59 – Improper Link Resolution Before File Access
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today