Legion Zone Application
Monthly
Arbitrary code execution in the Lenovo Legion Zone application allows an attacker positioned on the same logical network (shared LAN or Wi-Fi segment) to run code of their choosing on the affected host. Exploitation requires the attacker to already hold low-level privileges on the network (CVSS PR:L), needs no user interaction, and can affect confidentiality, integrity, and availability - reflected in the reported CVSS 4.0 base score of 8.6 (assessed as CVSS 3.1 8.2-equivalent, AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The issue is a moderate-to-high severity but realistically constrained problem, because Legion Zone is distributed exclusively in the Chinese market and the attack surface is limited to adjacent-network reachability; no public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV.
Arbitrary code execution in the Lenovo Legion Zone application allows an attacker positioned on the same logical network (shared LAN or Wi-Fi segment) to run code of their choosing on the affected host. Exploitation requires the attacker to already hold low-level privileges on the network (CVSS PR:L), needs no user interaction, and can affect confidentiality, integrity, and availability - reflected in the reported CVSS 4.0 base score of 8.6 (assessed as CVSS 3.1 8.2-equivalent, AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The issue is a moderate-to-high severity but realistically constrained problem, because Legion Zone is distributed exclusively in the Chinese market and the attack surface is limited to adjacent-network reachability; no public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV.