Dock Manager
Monthly
Privilege escalation in Lenovo Dock Manager exposes local authenticated users to full system compromise via an improperly protected cryptographic key, discovered during Lenovo's own internal security assessment. An attacker with a standard local user account can extract the weakly protected key and leverage it to elevate privileges on the affected endpoint. No public exploit has been identified at time of analysis; Lenovo has released a patch via advisory LEN-223470.
Privilege escalation in Lenovo Dock Manager allows a local authenticated user to execute arbitrary code with elevated privileges by exploiting improper file or directory permissions (CWE-276). The flaw was identified during Lenovo's own internal security assessment, suggesting proactive vendor discovery rather than external researcher or attacker-driven disclosure. No public exploit code has been identified at time of analysis, and the local-only attack vector (AV:L, PR:L) meaningfully constrains real-world exposure compared to network-exploitable vulnerabilities, though enterprise environments with shared Lenovo workstations should treat this as a genuine privilege escalation risk.
Arbitrary file deletion with elevated privileges affects Lenovo Dock Manager across all tracked versions (CPE: cpe:2.3:a:lenovo:dock_manager:*:*:*:*:*:*:*:*). An authenticated local user can exploit this CWE-59 link-following flaw to redirect the application's privileged file deletion routine to arbitrary targets outside the user's permitted scope, threatening both system integrity and availability. The vulnerability was identified through Lenovo's own internal security assessment; a vendor patch is available via advisory LEN-223470, and no public exploit has been identified at time of analysis.
Privilege escalation in Lenovo Dock Manager exposes local authenticated users to full system compromise via an improperly protected cryptographic key, discovered during Lenovo's own internal security assessment. An attacker with a standard local user account can extract the weakly protected key and leverage it to elevate privileges on the affected endpoint. No public exploit has been identified at time of analysis; Lenovo has released a patch via advisory LEN-223470.
Privilege escalation in Lenovo Dock Manager allows a local authenticated user to execute arbitrary code with elevated privileges by exploiting improper file or directory permissions (CWE-276). The flaw was identified during Lenovo's own internal security assessment, suggesting proactive vendor discovery rather than external researcher or attacker-driven disclosure. No public exploit code has been identified at time of analysis, and the local-only attack vector (AV:L, PR:L) meaningfully constrains real-world exposure compared to network-exploitable vulnerabilities, though enterprise environments with shared Lenovo workstations should treat this as a genuine privilege escalation risk.
Arbitrary file deletion with elevated privileges affects Lenovo Dock Manager across all tracked versions (CPE: cpe:2.3:a:lenovo:dock_manager:*:*:*:*:*:*:*:*). An authenticated local user can exploit this CWE-59 link-following flaw to redirect the application's privileged file deletion routine to arbitrary targets outside the user's permitted scope, threatening both system integrity and availability. The vulnerability was identified through Lenovo's own internal security assessment; a vendor patch is available via advisory LEN-223470, and no public exploit has been identified at time of analysis.