Lenovo
Monthly
Improper authorization in Lenovo Baiying PC Client - software distributed exclusively in the Chinese market - lets a local, already-authenticated user execute arbitrary code with elevated privileges, resulting in high impact to confidentiality, integrity, and availability. The vendor rates it 7.0 under CVSS 4.0 (CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N), and our independent CVSS 3.1 assessment is consistent: the vector is strictly local (AV:L), requires a valid logged-in session (PR:L) and some passive user interaction (UI:P), so it is not remotely triggerable. There is no public exploit identified at time of analysis and the CVE is not in CISA KEV, so real-world risk is concentrated in Chinese-market endpoints where a low-privileged local user has interactive access.
Multiple Lenovo consumer tablets - including the Idea Tab Pro (TB373FU), Idea Tab / Lenovo Tab K11 Gen 2 (TB336FU/TB336ZU), Tab M11 (TB330FU/TB330XU), Legion Tab 8.8" Gen 3 (TB321FU), Tab Extreme (TB570FU/TB570ZU), and a broader set of Tab and Yoga Tab models - contain a physical-access authentication bypass (CWE-288) that lets someone in direct possession of the device defeat the lock/authentication flow and gain unauthorized access to the device and its data. Rated 7.0 under CVSS 4.0 (AV:P/AC:L/AT:N/PR:N/UI:N with high confidentiality, integrity and availability impact), the issue requires no credentials (PR:N) and no user interaction (UI:N), so the decisive limiting factor is the Physical attack vector: there is no remote or adjacent-network exposure and only lost, stolen or unattended units are at risk. No public exploit code has been identified at time of analysis, and the specific alternate authentication path involved has not been disclosed by the vendor.
Arbitrary code execution in the Lenovo Legion Zone application allows an attacker positioned on the same logical network (shared LAN or Wi-Fi segment) to run code of their choosing on the affected host. Exploitation requires the attacker to already hold low-level privileges on the network (CVSS PR:L), needs no user interaction, and can affect confidentiality, integrity, and availability - reflected in the reported CVSS 4.0 base score of 8.6 (assessed as CVSS 3.1 8.2-equivalent, AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The issue is a moderate-to-high severity but realistically constrained problem, because Legion Zone is distributed exclusively in the Chinese market and the attack surface is limited to adjacent-network reachability; no public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV.
Sensitive health-data exposure in the Lenovo Health Android application (distributed exclusively in the Chinese market) stems from hardcoded credentials (CWE-798) that let an attacker access users' health-related information without legitimate authentication. Reported by Lenovo PSIRT and tracked under a single Lenovo advisory, it carries a CVSS 4.0 base of 9.3 driven by high confidentiality impact. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV.
Local privilege escalation in Lenovo Rescue and Smart Assistant (LMSA) enables a local authenticated user to execute arbitrary code with elevated privileges by exploiting a capture-and-replay authentication bypass (CWE-290) in the application's privileged service layer. The vulnerability is strictly local in scope per the CVSS 4.0 vector (AV:L/PR:L), limiting the threat to attackers who already hold a standard user account on an affected Lenovo device. Lenovo has published advisory LEN-217409 with remediation guidance; no public exploit has been identified at time of analysis.
Improper export of Android application components in Lenovo File Manager (Chinese-market distribution) enables a locally authenticated user or co-installed application to read or modify files that the application designates as protected. The root cause is CWE-926, where one or more Android components - likely a content provider or activity - are exported without enforcing the application's own authorization logic. No public exploit code exists and the vulnerability has not been added to CISA KEV; however, the CVSS 4.0 score of 8.4 reflects genuine high-impact file access if an attacker can install a companion malicious application on the target device.
Privilege escalation in the Lenovo Filez Client application allows a local authenticated user to gain elevated system rights via improper file or directory permissions (CWE-276). The CVSS 4.0 score of 8.5 reflects a meaningful local attack path with low complexity and no special attack requirements, though exploitation is bounded by the requirement for an existing local foothold. No active exploitation or public proof-of-concept has been identified at time of analysis.
Privilege escalation via symlink following in Lenovo Vantage and Lenovo Commercial Vantage allows a local authenticated user to execute arbitrary code with elevated privileges on affected Lenovo systems. Discovered during an internal Lenovo security assessment, the flaw (CWE-59) arises when a privileged Vantage component resolves attacker-controlled symbolic links without validation, enabling redirection of file operations to security-sensitive targets. No public exploit code or active exploitation has been confirmed at time of analysis; CVSS 4.0 scores this at 7.3 with a local attack vector and specific attack requirements present.
Privilege escalation in Lenovo Accessories and Display Manager for Enterprise for Windows allows a local authenticated user with low-level privileges to execute arbitrary code at elevated privilege levels, stemming from a hard-coded cryptographic key (CWE-321). The vulnerability was surfaced during an internal Lenovo security assessment and affects all versions of the product per the CPE wildcard. No public exploit code or CISA KEV listing is identified at time of analysis; a vendor patch is confirmed available via Lenovo advisory LEN-213038.
Privilege escalation in Lenovo Dock Manager exposes local authenticated users to full system compromise via an improperly protected cryptographic key, discovered during Lenovo's own internal security assessment. An attacker with a standard local user account can extract the weakly protected key and leverage it to elevate privileges on the affected endpoint. No public exploit has been identified at time of analysis; Lenovo has released a patch via advisory LEN-223470.
Privilege escalation in Lenovo Dock Manager allows a local authenticated user to execute arbitrary code with elevated privileges by exploiting improper file or directory permissions (CWE-276). The flaw was identified during Lenovo's own internal security assessment, suggesting proactive vendor discovery rather than external researcher or attacker-driven disclosure. No public exploit code has been identified at time of analysis, and the local-only attack vector (AV:L, PR:L) meaningfully constrains real-world exposure compared to network-exploitable vulnerabilities, though enterprise environments with shared Lenovo workstations should treat this as a genuine privilege escalation risk.
Lenovo System Update contains an authentication bypass (CWE-290) that permits a locally authenticated standard user to circumvent privilege checks and execute arbitrary code with elevated system privileges. Affected products span all tracked versions per CPE data, with Lenovo confirming the issue and releasing a patch under advisory LEN-213316. No public exploit code or CISA KEV listing has been identified at time of analysis, limiting immediate threat to environments where adversaries already have local user access.
OS command injection in Lenovo XClarity Orchestrator (LXCO) 2.2.0 enables an authenticated low-privileged attacker to execute arbitrary operating system commands with elevated privileges under a specific, undisclosed circumstance. LXCO is an enterprise data center orchestration platform that manages Lenovo server and chassis infrastructure, making successful exploitation highly impactful to infrastructure availability, integrity, and confidentiality. No public exploit code or CISA KEV listing has been identified at time of analysis; a vendor patch is available via the Lenovo advisory.
Improper TLS certificate validation in multiple Lenovo XClarity Orchestrator (LXCO) 2.2.0 microservices exposes sensitive management communications to interception by an adjacent network attacker capable of positioning themselves for a machine-in-the-middle attack. The flaw (CWE-295) allows the attacker to bypass HTTPS trust enforcement under unspecified triggering circumstances, potentially capturing credentials, tokens, or orchestration data exchanged between LXCO microservices. No public exploit code or CISA KEV listing exists at time of analysis; Lenovo has released a patch via advisory HT509976.
PowerShell command injection in Lenovo XClarity Integrator for Microsoft Windows Admin Center (versions 5.1.1 and below) running on the WAC Gateway allows an authenticated low-privileged attacker to inject arbitrary PowerShell commands when the plugin establishes remote PowerShell sessions. Successful exploitation yields high-impact code execution that extends beyond the plugin into subsequent systems (managed hosts), with full confidentiality, integrity, and availability compromise. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Local privilege escalation to arbitrary code execution affects Lenovo App Store, a software-distribution client shipped exclusively on Lenovo devices in the Chinese market. A local authenticated user who can interact with the application can leverage its excessive privileges (CWE-250) to run arbitrary code at an elevated privilege level, with high confidentiality, integrity, and availability impact on the host. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so no active exploitation is confirmed.
Local code execution in Lenovo App Store (Chinese-market distribution only) lets an authenticated local user abuse a path traversal weakness to write or load files outside intended directories and run arbitrary code. The flaw was self-reported by Lenovo and carries a CVSS 4.0 base score of 7.0; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. Impact is high to confidentiality, integrity, and availability of the local system, but exploitation requires existing low-privilege local access plus user interaction.
Local code execution in Lenovo Legion Zone and the Lenovo App Store (China-market Windows builds) allows an authenticated local user to run arbitrary code when either application is installed on a non-system partition. The flaw stems from insecure directory/file permissions (CWE-277) that a low-privileged user can abuse to plant or modify executable content later run with higher privilege. No public exploit is identified at time of analysis and it is not listed in CISA KEV; impact is confined to systems where these Chinese-market Lenovo utilities are deployed to a non-default drive.
Local privilege escalation in the FluxInk (formerly Sunia SPB Peripheral) Color Management Driver TcnPeripheral64.sys version 1.0.7.2 lets a standard user map arbitrary physical memory via the \Device\PhysicalMemory object and gain kernel-level control. The flaw affects Lenovo systems shipping this signed color-management driver and is fixed in version 1.0.7.6. Publicly available exploit code exists; there is no public exploit identified as actively exploited (not in CISA KEV), though the vulnerability was reported by CISA (cisa-cg).
Privilege escalation in Lenovo Smart Connect for Windows allows a local authenticated user to bypass authentication checks and execute arbitrary code with elevated privileges. The flaw stems from an authentication bypass weakness (CWE-290) in the Windows client and carries a CVSS 4.0 score of 7.3. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Local privilege escalation in Lenovo's LanSchool Classic client application allows authenticated users on affected endpoints to execute arbitrary code with elevated privileges via an uncontrolled search path (CWE-427). The flaw carries a CVSS 4.0 score of 8.5 with high impact across confidentiality, integrity, and availability, and no public exploit identified at time of analysis. Because LanSchool Classic is widely deployed in K-12 and education environments, exploitation could let a student or low-privileged user gain SYSTEM-level control of managed classroom devices.
Local privilege escalation in Lenovo Accessories and Display Manager for Enterprise on Windows allows an authenticated low-privileged user to execute arbitrary code with elevated privileges, per a Lenovo-disclosed internal finding (LEN-213623). The CVSS 4.0 base score of 8.5 reflects high impact to confidentiality, integrity, and availability of the vulnerable system, though no public exploit identified at time of analysis. The CWE-306 (Missing Authentication for Critical Function) classification combined with the 'Authentication Bypass' tag suggests a privileged operation in the product is reachable without proper access checks.
Out-of-bounds read in the Linux kernel's AppArmor LSM subsystem (security/apparmor/match.c) allows a local low-privileged user to trigger a KASAN slab-out-of-bounds read via the mount() syscall on kernels 7.0 through 7.0.3 and 7.1-rc1. The flaw stems from a missing string terminator that causes aa_dfa_match() to read past the end of an 8KB kmalloc buffer when processing mount path strings, resulting in potential information disclosure and system instability (denial of service). No public exploit identified at time of analysis, and EPSS probability is negligible at 0.02%.
Path traversal in Lenovo Personal Cloud Storage devices allows authenticated remote attackers to move or access files belonging to other users on the same device, enabling unauthorized data disclosure and modification across user boundaries. Affects multiple product lines including Personal Cloud (T1, T2, T2S, T2Pro, X1, X1S, A1, A1S) and Home Storage Hub (T20, X20). CVSS 8.6 reflects high confidentiality and integrity impact with low attack complexity. No active exploitation confirmed in CISA KEV at time of analysis, and EPSS data not available for this 2026 CVE identifier.
Remote command execution in Lenovo Personal Cloud Storage devices (T1, T2, T2S, T2Pro, X1, X1S, A1, A1S, and Home Storage Hub T20/X20) allows authenticated users on the local network to execute arbitrary commands via OS command injection (CWE-78). The CVSS v4.0 score of 8.7 reflects complete system compromise potential (VC:H/VI:H/VA:H) through network attack with low complexity but requiring low-privilege authentication (AV:N/AC:L/PR:L). No evidence of active exploitation (not in CISA KEV) or public exploit code identified at time of analysis. Lenovo has issued advisories including end-of-life notices for certain models (T1), indicating some affected products may not receive patches.
Use-after-free in Linux kernel q6apm audio driver allows local authenticated attackers with low privileges to achieve arbitrary code execution, denial of service, or information disclosure with high impact to confidentiality, integrity, and availability. The flaw affects Qualcomm ASoC q6apm component registration code used in devices like Lenovo 21N2ZC5PUS laptops. Vendor-released patches are available across multiple kernel version branches (6.12.83, 6.18.24, 6.19.14, 7.0.1). EPSS score of 0.02% (5th percentile) indicates low probability of mass exploitation despite high CVSS 7.8, with no confirmed active exploitation or public POC identified at time of analysis.
Local privilege escalation in Lenovo Software Fix versions prior to 7.5.5.19 allows an authenticated local attacker to execute arbitrary code with elevated privileges via argument injection. While the CVSS 4.0 score is 8.5, exploitation requires local authenticated access and no active exploitation or public exploit is known; EPSS probability is extremely low (0.01%).
Local privilege escalation in Lenovo Software Fix versions prior to 7.5.5.19 allows an authenticated user to execute arbitrary code with elevated privileges during installation via an uncontrolled search path (CWE-427). The vulnerability requires local access and user interaction to run the installer. No active exploitation or public exploit code is known at this time.
Improper TLS certificate validation in Lenovo Filez (Windows and Android) enables an adjacent-network attacker who can intercept application traffic to present a fraudulent certificate, inject malicious server responses, and achieve arbitrary code execution on the victim's device. Both Windows and Android clients are confirmed affected per NVD CPE data with no version upper bound specified. No public exploit code has been identified and EPSS probability is 0.01%, though the impact if exploitation succeeds is fully classified as high across confidentiality, integrity, and availability.
The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception handling and error-message generation during file-upload attempts, which allows. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Lenovo System Update (formerly ThinkVantage System Update) before 5.06.0034 uses predictable security tokens, which allows local users to gain privileges by sending a valid token with a command to. Rated high severity (CVSS 7.2), this vulnerability is low attack complexity. Public exploit code available and EPSS exploitation probability 29.6%.
Directory traversal vulnerability in the VulCore web service (WSVulnerabilityCore/VulCore.asmx) in Lenovo ThinkManagement Console 9.0.3 allows remote attackers to delete arbitrary files via a .. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 77.4%.
Unrestricted file upload vulnerability in andesk/managementsuite/core/core.anonymous/ServerSetup.asmx in the ServerSetup web service in Lenovo ThinkManagement Console 9.0.3 allows remote attackers to. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 86.5%.
Arbitrary code execution is possible on a broad set of Lenovo consumer tablets - including the Idea Tab Pro TB373FU, Idea Tab / Lenovo Tab K11 Gen 2 TB336FU and TB336ZU, Legion Tab TB321FU, Tab M11 TB330FU and TB330XU, Tab Extreme TB570FU and TB570ZU, and Tab K11 TB330FUP, with additional models enumerated in vendor tagging (Tab K11 Plus, Tab K9, Tab One, Tab P12, Tab Plus, Yoga Tab, Yoga Tab Plus, and the TB311FU/TB311XU folio and clear-case variants) - by an attacker who has physical possession of the tablet while it is already unlocked. The CVSS 4.0 base score is 5.4 (MEDIUM), with vector AV:P/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N, meaning exploitation requires the attacker to be physically at the device (AV:P), no prior privileges are needed (PR:N), no victim interaction is required beyond the device already being unlocked (UI:N), and attack requirements are present (AT:P) in the form of physical custody plus an unlocked state; the flaw affects a device's own confidentiality, integrity and availability but does not propagate to subsequent systems. No CISA KEV listing is associated with this CVE and no public exploit code has been identified at time of analysis, so real-world risk is bounded by the physical and unlocked-device preconditions - a locked, powered-off, or patched unit is not exploitable via this issue.
An out-of-bounds write in the Lenovo Energy Management kernel-mode driver lets a local authenticated user crash the affected Windows host with a blue-screen (kernel bugcheck) error, producing a denial-of-service condition on systems where the driver is installed and loaded. The flaw is availability-only: the assessed impact is kernel memory corruption leading to a crash, with no demonstrated path to code execution or data disclosure, and it requires the attacker to already hold a local session on the machine (PR:L) - there is no network-reachable attack surface. No public exploit code and no evidence of active exploitation were identified at time of analysis, so this should be treated as a moderate-severity, patch-and-move-on item rather than an emergency; the vendor advisory is Lenovo LEN-218444.
Sensitive information disclosure in Lenovo Smart Camera C33 - and the related C33 Pro, C35, RQ3, XW1, X6T, X6Q and Smart Network PTZ X5T/X5Q/X5E models - allows an attacker who is already positioned on the same adjacent network segment to read confidential data from the device without authenticating or relying on user interaction. The root cause class (CWE-1393, use of default password) points to weak or default credentials or secrets as the disclosure vector, and the CVSS v4.0 vector carries an AT:P precondition, meaning specific device state or configuration conditions must also hold, so this is not a direct internet-facing exploit. Exploitation is further limited because these cameras were distributed exclusively in the Chinese market; no public exploit code has been identified at time of analysis, and the independently assessed severity is a moderate, context-dependent risk rather than a top-tier emergency.
Improper TLS certificate validation in Lenovo Smart Camera firmware lets a network-adjacent attacker who has already established a man-in-the-middle position on the same local or Wi-Fi segment intercept the camera's network communications and read the traffic it protects. Unauthenticated attackers are sufficient (PR:N), and only the victim's ordinary camera or companion-app activity is required for capture (passive user interaction), with high confidentiality impact but no availability impact. Affected devices include the Smart Camera C33, C33 Pro, C35, RQ3, XW1, X6T, X6Q, C5X and X9T plus the Smart Network PTZ X5T, X5Q and X5E, all sold exclusively in the Chinese market, which sharply narrows the realistic target population. No public exploit identified at time of analysis and no CISA KEV listing; at CVSS 4.0 base 5.9 this is a medium-severity, low real-world priority issue rather than an urgent one, consistent with the requirement to first obtain an adjacent MITM position and with the absence of internet-facing exposure.
In the Linux kernel, the following vulnerability has been resolved: clk: qcom: camcc-sc8280xp: unregister CAMCC_GDSC_CLK With the introduction of sync_state support in the clk and pmdomain subsystems, the following warning happens when the unused clocks are shutdown in camcc-sc8280xp: [ 15.408367] titan_top_gdsc status stuck at 'on' [ 15.408429] WARNING: drivers/clk/qcom/gdsc.c:178 at gdsc_toggle_logic+0x14c/0x160, CPU#2: kworker/u32:1/14 [ 15.408462] Modules linked in: bnep vfat fat ath11k_pci(+) ath11k mac80211 cfg80211 mhi libarc4 snd_soc_wcd938x snd_soc_wcd938x_sdw snd_soc_wcd_classh hci_uart snd_soc_wcd_common snd_soc_sc8280xp soundwire_qcom snd_soc_wcd_mbhc snd_soc_qcom_sdw slimbus snd_soc_qcom_common regmap_sdw btqca btrtl qcom_camss soundwire_bus btbcm btintel snd_soc_sdca snd_soc_lpass_wsa_macro bluetooth snd_soc_lpass_tx_macro snd_soc_lpass_va_macro snd_soc_lpass_rx_macro snd_soc_hdmi_codec snd_soc_lpass_macro_common videobuf2_dma_sg ov5675 v4l2_fwnode videobuf2_memops qcom_spmi_adc5 snd_soc_core qcom_spmi_adc_tm5 videobuf2_v4l2 snd_seq snd_seq_device videobuf2_common v4l2_async qcom_vadc_common qcom_spmi_temp_alarm pm8941_pwrkey industrialio videodev snd_compress rfkill ac97_bus snd_pcm_dmaengine qcom_tsens mc qcom_edac snd_pcm pci_pwrctrl_pwrseq qcom_cpufreq_hw snd_timer snd qcomtee soundcore tee leds_gpio joydev binfmt_misc zram lz4hc_compress governor_simpleondemand panel_edp msm xhci_plat_hcd nvme nvme_core dwc3 qcom_pm8008_regulator [ 15.408688] ucsi_glink nvme_keyring nvme_auth pmic_glink_altmode udc_core typec_ucsi aux_hpd_bridge qcom_battmgr ulpi ubwc_config socinfo ocmem drm_gpuvm qcom_q6v5_pas drm_exec qcom_pil_info leds_qcom_lpg gpu_sched led_class_multicolor rtc_pm8xxx qcom_pbs qcom_common drm_display_helper qcom_pon qcom_glink_smem qcom_glink ghash_ce pwrseq_qcom_wcn gpio_sbu_mux qcom_stats phy_qcom_qmp_combo qcom_q6v5 gf128mul cec dispcc_sc8280xp phy_qcom_edp camcc_sc8280xp i2c_qcom_cci qcom_sysmon drm_dp_aux_bus mdt_loader aux_bridge qcom_pm8008 i2c_hid_of_elan dwc3_qcom_legacy llcc_qcom icc_bwmon gpi typec qcom_refgen_regulator phy_qcom_qmp_usb nvmem_qfprom qcom_ipcc phy_qcom_snps_femto_v2 gpucc_sc8280xp pinctrl_sc8280xp_lpass_lpi qcom_hwspinlock pinctrl_lpass_lpi lpasscc_sc8280xp qrtr qcom_aoss pmic_glink pdr_interface phy_qcom_qmp_pcie qcom_smd qcom_pdr_msg icc_osm_l3 qcom_wdt qmi_helpers qcom_rng smp2p rpmsg_core gpio_keys pwm_bl smem hid_multitouch fuse i2c_dev [ 15.408928] CPU: 2 UID: 0 PID: 14 Comm: kworker/u32:1 Not tainted 7.1.0+ #2 PREEMPT(lazy) [ 15.408937] Hardware name: LENOVO 21BX0016US/21BX0016US, BIOS N3HET88W (1.60 ) 03/14/2024 [ 15.408942] Workqueue: pm pm_runtime_work [ 15.408959] pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 15.408967] pc : gdsc_toggle_logic+0x14c/0x160 [ 15.408978] lr : gdsc_toggle_logic+0x14c/0x160 [ 15.408987] sp : ffff8000800f3b40 [ 15.408991] x29: ffff8000800f3b40 x28: 0000000000000000 x27: 0000000000000000 [ 15.409003] x26: 0000000000000000 x25: 0000000000000000 x24: 0000000000000000 [ 15.409014] x23: 0000000000000000 x22: 0000000000000001 x21: ffffa33f298fca88 [ 15.409024] x20: 0000000000000000 x19: ffffa33f298fc5b0 x18: 00cd15db75dacefd [ 15.409035] x17: 000000040044ffff x16: ffffa33f3b1a3d88 x15: 726f776b80000002 [ 15.409045] x14: ffffffffffffffff x13: 0000000000000028 x12: 0101010101010101 [ 15.409056] x11: 7f7f7f7f7f7f7f7f x10: fefeff3039313274 x9 : ffffa33f3a5edafc [ 15.409067] x8 : ffff8000800f3780 x7 : 0000000000000001 x6 : 0000000000000001 [ 15.409078] x5 : ffff000bf3ca1288 x4 : 0000000000000000 x3 : ffff5cccb6a3f000 [ 15.409088] x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff000080ae0000 [ 15.409098] Call trace: [ 15.409103] gdsc_toggle_logic+0x14c/0x160 (P) [ 15.409115] gdsc_disable+0x4c/0x190 [ 15.409126] _genp ---truncated---
Out-of-bounds memory access in the ELAN TrackPoint device driver on Lenovo ThinkPad and related laptops allows a local authenticated user to crash the operating system under specific conditions, resulting in a denial-of-service. Disclosed by Lenovo via advisory LEN-213604, the vulnerability spans a very large number of ThinkPad model lines running Windows 10 and Windows 11. No public exploit code has been identified and the vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog, consistent with its local-only, high-complexity attack profile.
Arbitrary file deletion with elevated privileges affects Lenovo Dock Manager across all tracked versions (CPE: cpe:2.3:a:lenovo:dock_manager:*:*:*:*:*:*:*:*). An authenticated local user can exploit this CWE-59 link-following flaw to redirect the application's privileged file deletion routine to arbitrary targets outside the user's permitted scope, threatening both system integrity and availability. The vulnerability was identified through Lenovo's own internal security assessment; a vendor patch is available via advisory LEN-223470, and no public exploit has been identified at time of analysis.
Arbitrary file deletion with elevated privileges is possible in the VantageCoreAddin component of Lenovo Vantage and Lenovo Commercial Vantage via an improper link following (symlink) attack. A local authenticated user operating with low privileges can exploit this to delete files outside their authorized scope by placing a malicious symbolic or hard link in a path the addin traverses with elevated rights. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
In the Linux kernel, the following vulnerability has been resolved: HID: hid-lenovo-go: cancel cfg_setup work in hid_go_cfg_remove() hid_go_cfg_probe() initialises drvdata.go_cfg_setup and schedules it to run 2 ms later: INIT_DELAYED_WORK(&drvdata.go_cfg_setup, &cfg_setup); schedule_delayed_work(&drvdata.go_cfg_setup, msecs_to_jiffies(2)); cfg_setup() dereferences drvdata.hdev to issue MCU command requests. hid_go_cfg_remove() tears down sysfs and stops the HID device, but never drains the delayed work. If the device is unbound within the 2 ms scheduling delay (a probe failure rolling back via remove, or a fast rmmod after probe), the work fires after hid_destroy_device() has dropped its reference and released the underlying hdev struct, leaving cfg_setup() with a stale drvdata.hdev pointer. Mirror the sibling driver hid-lenovo-go-s.c, whose hid_gos_cfg_remove() already calls cancel_delayed_work_sync() on its analogous work, and drain go_cfg_setup at the top of hid_go_cfg_remove(). The cancel must come before guard(mutex)(&drvdata.cfg_mutex) because cfg_setup() acquires that mutex; reversing the order would deadlock.
Insecure temporary file creation in Lenovo XClarity Essentials OneCLI 5.5.0 and earlier on Linux enables a local low-privileged attacker to overwrite or truncate arbitrary system files via a race condition (CWE-377), but only when a privileged user concurrently executes OneCLI with elevated rights. The attack timing requirement (AT:P in the vendor CVSS 4.0 vector) confirms this is a classic TOCTOU-style symlink race, limiting realistic exploitation to shared multi-user Linux environments where an administrator routinely runs the tool elevated. No public exploit code or CISA KEV listing exists; the vendor has released a patch via advisory LEN-ht116433.
Deadlock in the Linux kernel's drm/msm (Qualcomm Snapdragon GPU) shrinker causes full kernel hang under memory reclaim pressure. The circular lock dependency arises when the kswapd0 thread holds fs_reclaim and the MSM gem shrinker calls dma_resv_lock(), which internally attempts to re-acquire fs_reclaim - producing a ABBA deadlock that renders the system unresponsive. Kernels in the affected range on Snapdragon-based hardware (Linux 6.17 through pre-patch 7.0.x and 6.18.x) are vulnerable; no public exploit code exists and no active exploitation has been confirmed.
In the Linux kernel, the following vulnerability has been resolved: platform/x86: lenovo-wmi-helpers: Fix memory leak in lwmi_dev_evaluate_int() lwmi_dev_evaluate_int() leaks output.pointer when retval == NULL (found by sashiko.dev [1]). Fix it by moving `ret_obj = output.pointer' outside of the `if (retval)' block so that it is always freed by the __free cleanup callback. No functional change intended.
Lenovo BIOS firmware across dozens of consumer and gaming laptop models - Legion, IdeaPad, Yoga, ThinkBook, LOQ, and V-series - contains a missing authentication flaw in the WMI-to-SMI interface that permits a local privileged attacker to arbitrarily trigger System Management Interrupt handlers, enabling execution at the SMM firmware level below the operating system security boundary. No public exploit code has been identified at time of analysis, and CISA KEV listing is not confirmed. The practical threat is post-compromise firmware persistence: an attacker already holding OS-level administrative privileges could use this flaw to manipulate firmware behavior in ways invisible to endpoint security tools, bypassing Secure Boot or implanting persistent code in System Management Mode.
Out-of-bounds write in Lenovo BIOS firmware across dozens of consumer and gaming laptop models enables a local attacker with high OS-level privileges to execute arbitrary code in System Management Mode (SMM) - a CPU execution context operating below the operating system and hypervisor with access to all system memory. Successful exploitation allows persistent firmware-level implants that survive OS reinstallation and defeat Secure Boot and standard endpoint detection tools. No public exploit has been identified at time of analysis, and this vulnerability is not listed in CISA KEV; however, SMM code execution represents one of the highest-impact firmware attack primitives available to an advanced threat actor.
SMM memory address disclosure in Lenovo laptop BIOS firmware exposes the location of protected System Management Mode (SMRAM) regions to a local privileged attacker. Dozens of Lenovo consumer, gaming, and business laptop product lines are affected across IdeaPad, Legion, Yoga, ThinkBook, LOQ, and V-series models. While the direct impact is confidentiality-only, SMRAM address disclosure is a classic prerequisite step in firmware-level attack chains that seek to bypass address-space protections and ultimately plant persistent SMM rootkits. No public exploit has been identified at time of analysis, and exploitation is not confirmed in CISA KEV.
Out-of-bounds write in Lenovo BIOS firmware across dozens of consumer and gaming laptop models enables a local privileged attacker to corrupt power management settings within System Management Mode, a CPU execution context operating below the OS kernel at Ring -2. Successful exploitation could allow persistent firmware-level tampering that survives OS reinstalls and reboots. No public exploit has been identified at time of analysis, and exploitation requires pre-existing high OS-level privileges, substantially limiting real-world risk to post-compromise scenarios.
Lenovo Smart Connect for Windows exposes an improper access control flaw that permits a local authenticated user to read files belonging to other users on the same machine. Discovered through Lenovo's own internal security assessment and documented under advisory LEN-218281, the flaw carries a CVSS 4.0 score of 6.8 with a local, low-privilege attack vector and high confidentiality impact. No public exploit code and no CISA KEV listing exist at time of analysis, limiting immediate risk to multi-user Windows environments where Lenovo Smart Connect is installed.
NULL pointer dereference in the Linux kernel's ASoC SDCA (SoundWire Device Class for Audio) subsystem crashes the kernel during audio device cleanup, resulting in a denial of service. The `sdca_dev_unregister_functions()` routine iterates over SDCA function descriptors without validating for NULL entries, which can be present when function registration fails partway through or when device cleanup races with probe deferral. This crash was observed in practice on Lenovo ThinkPad X1 Carbon G14 (Panther Lake) systems where missing SOF firmware caused the SOF audio driver probe to fail, triggering the NULL dereference during subsequent SoundWire device teardown. No public exploit exists and EPSS sits at 0.14% (4th percentile), reflecting the hardware-specific and locally-triggered nature of this flaw.
NULL pointer dereference in the Linux kernel's ps883x USB Type-C retimer driver causes a kernel Oops during device unbind, resulting in a denial of service. The ps883x_retimer_remove() function calls i2c_get_clientdata() to retrieve driver-private state, but i2c_set_clientdata() was never called during probe, leaving the pointer NULL; dereference at offset 0x20 triggers a fatal translation fault. Systems with ps883x retimer hardware running affected kernel versions are vulnerable when a privileged local user unbinds the driver via sysfs. No active exploitation is confirmed (no CISA KEV listing), and the EPSS score of 0.17% (6th percentile) reflects negligible real-world exploitation probability.
Local privilege escalation to System Management Mode (SMM) in Lenovo ThinkPad BIOS firmware allows a high-privileged local user to execute arbitrary code at one of the most privileged execution rings on x86 hardware. The flaw, an out-of-bounds write (CWE-787) discovered by Lenovo during an internal security assessment, affects a wide range of current-generation ThinkPad models including X1 Carbon 13th Gen, X13 Gen 6, T14s Gen 6, P14s/P16v Gen 3, L13/L14/L16 Gen 6, and E16 Gen 3. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Arbitrary privileged memory read/write in Lenovo ThinkPad embedded controller (EC) firmware allows a local administrator on affected ThinkPad models (X13 Gen 6, X1 Carbon 13th Gen, P16v Gen 3, L16 Gen 1/2, T14s Gen 6, P14s Gen 6, L13 Gen 6, L14 Gen 6) to access or modify protected memory regions. Discovered during Lenovo's internal security assessment, the issue is rated CVSS 4.0 8.4 (High) and there is no public exploit identified at time of analysis, with no CISA KEV listing. Despite the high score, exploitation requires high privileges and local access, narrowing realistic abuse to attackers who already have admin on the host or to supply-chain/insider scenarios.
Clipboard hijacking in Lenovo's built-in Android browser application allows a malicious website to silently overwrite system clipboard contents on affected devices. The vulnerability impacts Lenovo Android tablets distributed exclusively in the Chinese market, enabling a network-based attacker to manipulate clipboard data when a user visits a crafted website. No confirmed active exploitation (CISA KEV) or public exploit code has been identified at time of analysis; EPSS data was not provided in available intelligence.
Kernel crash (local denial of service) in the Linux nouveau NVIDIA GPU driver allows a local authenticated user to trigger a kernel WARNING and system instability by accessing the DisplayPort AUX channel (/dev/drm_dp_*) while the GPU is in runtime-suspended state. The driver fails to check device power state before invoking the GSP (GPU System Processor) firmware communication path, causing an unhandled condition in r535_gsp_msgq_wait. No public exploit exists and the EPSS score is 0.02% (7th percentile), but the vulnerability is notable in environments where fwupd or similar firmware tools interact with DP AUX interfaces on systems using the nouveau driver with runtime power management enabled.
Kernel denial of service in rtw88 WiFi driver 8822b chipset allows local authenticated users to trigger a kernel WARNING and potential system instability by setting antenna configuration while the wireless chip is powered off, causing unexpected values when RF registers are read during power-down state.
Arbitrary file write with elevated privileges in Lenovo Software Fix installer allows local authenticated users to overwrite system files during installation. Affected versions before 7.5.5.19. No public exploitation reported, EPSS low (0.01%), and SSVC
DLL hijacking in Lenovo Service Bridge prior to version 5.0.2.20 allows a local authenticated user to execute arbitrary code with elevated privileges by planting a malicious DLL in a directory resolved before the legitimate library during application load. Confirmed by Lenovo security advisory LEN-211071 and EUVD-2026-22919, this is a CWE-427 uncontrolled search path issue confined entirely to local exploitation. No public exploit has been identified at time of analysis, and EPSS at 0.01% (2nd percentile) reflects negligible observed exploitation activity.
Arbitrary file write with elevated privileges exists in Lenovo Diagnostics and HardwareScanAddin components of Lenovo Vantage. A local authenticated user can overwrite files during installation or hardware scan, posing integrity and availability risks. No active exploitation or public exploits have been identified (EPSS 0.01%), and a vendor patch is available.
Lenovo PC Manager permits local authenticated users to terminate privileged processes due to improper privilege management, potentially disrupting system operations or enabling denial of service. An attacker with valid credentials could leverage this vulnerability to halt critical processes without administrative approval. No patch is currently available to address this issue.
LenovoProductivitySystemAddin in Lenovo Vantage and Baiying contains an input validation flaw that enables local authenticated users to terminate arbitrary processes with elevated privileges. This medium-severity vulnerability (CVSS 6.8) requires local access and valid credentials but poses a significant availability risk. No patch is currently available.
Lenovo Vantage and Baiying DeviceSettingsSystemAddin contain an input validation flaw that allows authenticated local users to delete arbitrary registry keys with elevated privileges. This vulnerability affects systems where users have local access and could enable attackers to modify system configuration or disable security controls. No patch is currently available.
Lenovo Vantage and Baiying DeviceSettingsSystemAddin contains an input validation flaw that allows authenticated local users to modify arbitrary registry keys with system-level privileges. This vulnerability could enable privilege escalation or system configuration tampering by an attacker with local access. No patch is currently available.
The Lenovo Virtual Bus driver in Smart Connect contains a divide-by-zero flaw that enables local authenticated users to trigger a system crash (blue screen). No patch is currently available, leaving affected Windows systems vulnerable to denial-of-service attacks by privileged local users.
The Lenovo Virtual Bus driver in Smart Connect contains a buffer overflow that allows local authenticated users to corrupt memory and trigger system crashes on Windows systems. This vulnerability requires valid credentials and local access, limiting exposure to users already present on affected machines. No patch is currently available to address this issue.
Lenovo Filez fails to properly validate SSL/TLS certificates, enabling network-positioned attackers to intercept encrypted communications and extract sensitive user information. The vulnerability requires an adjacent network position and specific conditions to exploit, but affects all users of the application. No patch is currently available.
A potential vulnerability was reported in the Lenovo FileZ Android application that, under certain conditions, could allow a local authenticated user to retrieve some sensitive data stored in a log file. [CVSS 2.8 LOW]
In the Linux kernel, the following vulnerability has been resolved: leds: led-class: Only Add LED to leds_list when it is fully ready Before this change the LED was added to leds_list before led_init_core() gets called adding it the list before led_classdev.set_brightness_work gets initialized.
Thinkplus Fu100 Firmware versions up to - is affected by authentication bypass by spoofing (CVSS 7.8).
Thinkplus Fu100 Firmware versions up to - is affected by cleartext transmission of sensitive information (CVSS 5.5).
Thinkplus Fu100 Firmware versions up to - is affected by missing encryption of sensitive data (CVSS 4.6).
In the Linux kernel, the following vulnerability has been resolved: usb: typec: ucsi: Handle incorrect num_connectors capability The UCSI spec states that the num_connectors field is 7 bits, and the 8th bit is reserved and should be set to zero.
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix NULL deref in debugfs odm_combine_segments When a connector is connected but inactive (e.g., disabled by desktop environments), pipe_ctx->stream_res.tg will be destroyed. Then, reading odm_combine_segments causes kernel NULL pointer dereference. BUG: kernel NULL pointer dereference, address: 0000000000000000 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 0 P4D 0 Oops: Oops: 0000 [#1] SMP NOPTI CPU: 16 UID: 0 PID: 26474 Comm: cat Not tainted 6.17.0+ #2 PREEMPT(lazy) e6a17af9ee6db7c63e9d90dbe5b28ccab67520c6 Hardware name: LENOVO 21Q4/LNVNB161216, BIOS PXCN25WW 03/27/2025 RIP: 0010:odm_combine_segments_show+0x93/0xf0 [amdgpu] Code: 41 83 b8 b0 00 00 00 01 75 6e 48 98 ba a1 ff ff ff 48 c1 e0 0c 48 8d 8c 07 d8 02 00 00 48 85 c9 74 2d 48 8b bc 07 f0 08 00 00 <48> 8b 07 48 8b 80 08 02 00> RSP: 0018:ffffd1bf4b953c58 EFLAGS: 00010286 RAX: 0000000000005000 RBX: ffff8e35976b02d0 RCX: ffff8e3aeed052d8 RDX: 00000000ffffffa1 RSI: ffff8e35a3120800 RDI: 0000000000000000 RBP: 0000000000000000 R08: ffff8e3580eb0000 R09: ffff8e35976b02d0 R10: ffffd1bf4b953c78 R11: 0000000000000000 R12: ffffd1bf4b953d08 R13: 0000000000040000 R14: 0000000000000001 R15: 0000000000000001 FS: 00007f44d3f9f740(0000) GS:ffff8e3caa47f000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000000 CR3: 00000006485c2000 CR4: 0000000000f50ef0 PKRU: 55555554 Call Trace: <TASK> seq_read_iter+0x125/0x490 ? __alloc_frozen_pages_noprof+0x18f/0x350 seq_read+0x12c/0x170 full_proxy_read+0x51/0x80 vfs_read+0xbc/0x390 ? __handle_mm_fault+0xa46/0xef0 ? do_syscall_64+0x71/0x900 ksys_read+0x73/0xf0 do_syscall_64+0x71/0x900 ? count_memcg_events+0xc2/0x190 ? handle_mm_fault+0x1d7/0x2d0 ? do_user_addr_fault+0x21a/0x690 ? exc_page_fault+0x7e/0x1a0 entry_SYSCALL_64_after_hwframe+0x6c/0x74 RIP: 0033:0x7f44d4031687 Code: 48 89 fa 4c 89 df e8 58 b3 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00> RSP: 002b:00007ffdb4b5f0b0 EFLAGS: 00000202 ORIG_RAX: 0000000000000000 RAX: ffffffffffffffda RBX: 00007f44d3f9f740 RCX: 00007f44d4031687 RDX: 0000000000040000 RSI: 00007f44d3f5e000 RDI: 0000000000000003 RBP: 0000000000040000 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000202 R12: 00007f44d3f5e000 R13: 0000000000000003 R14: 0000000000000000 R15: 0000000000040000 </TASK> Modules linked in: tls tcp_diag inet_diag xt_mark ccm snd_hrtimer snd_seq_dummy snd_seq_midi snd_seq_oss snd_seq_midi_event snd_rawmidi snd_seq snd_seq_device x> snd_hda_codec_atihdmi snd_hda_codec_realtek_lib lenovo_wmi_helpers think_lmi snd_hda_codec_generic snd_hda_codec_hdmi snd_soc_core kvm snd_compress uvcvideo sn> platform_profile joydev amd_pmc mousedev mac_hid sch_fq_codel uinput i2c_dev parport_pc ppdev lp parport nvme_fabrics loop nfnetlink ip_tables x_tables dm_cryp> CR2: 0000000000000000 ---[ end trace 0000000000000000 ]--- RIP: 0010:odm_combine_segments_show+0x93/0xf0 [amdgpu] Code: 41 83 b8 b0 00 00 00 01 75 6e 48 98 ba a1 ff ff ff 48 c1 e0 0c 48 8d 8c 07 d8 02 00 00 48 85 c9 74 2d 48 8b bc 07 f0 08 00 00 <48> 8b 07 48 8b 80 08 02 00> RSP: 0018:ffffd1bf4b953c58 EFLAGS: 00010286 RAX: 0000000000005000 RBX: ffff8e35976b02d0 RCX: ffff8e3aeed052d8 RDX: 00000000ffffffa1 RSI: ffff8e35a3120800 RDI: 0000000000000000 RBP: 0000000000000000 R08: ffff8e3580eb0000 R09: ffff8e35976b02d0 R10: ffffd1bf4b953c78 R11: 0000000000000000 R12: ffffd1bf4b953d08 R13: 0000000000040000 R14: 0000000000000001 R15: 0000000000000001 FS: 00007f44d3f9f740(0000) GS:ffff8e3caa47f000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000000 CR3: 00000006485c2000 CR4: 0000000000f50ef0 PKRU: 55555554 Fix this by checking pipe_ctx-> ---truncated---
Local privilege escalation in the Lenovo Baiying Client allows an authenticated low-privilege user to execute code with elevated privileges by abusing improperly secured files, directories, or service components of the client. Only hosts running this Lenovo client - predominantly Lenovo-managed and China-market environments - are exposed, since exploitation requires an existing account on the local machine and there is no network-reachable vector. Risk is currently low in the wider ecosystem: EPSS is 0.12% (2nd percentile), no public exploit code has been identified at time of analysis, and the issue is not listed as confirmed actively exploited (CISA KEV).
Local privilege escalation in Lenovo One Client on Windows allows an authenticated local attacker to execute code with elevated privileges via DLL hijacking (CWE-427). The attacker must write a malicious DLL to a directory searched by the application; no public exploit identified at time of analysis and EPSS is low (0.14%, 2nd percentile). The vendor rates this 8.5 (CVSS 4.0), while our independent assessment yields a CVSS 3.1 base score of 7.8 (High).
DLL hijacking in Lenovo App Store and Lenovo Browser allows a local authenticated user to execute arbitrary code with elevated privileges on Windows systems where these applications are installed. Exploitation requires the attacker to already have a low-privileged local foothold and to place a malicious DLL in a location the application searches before the legitimate library, and the vendor notes this works only 'under certain conditions'. No public exploit code or active exploitation has been identified at time of analysis, and the EPSS score is low at 0.14% (2nd percentile), though the flaw carries a high CVSS 4.0 base score of 8.5.
An improper permissions vulnerability was reported in Lenovo App Store that could allow a local authenticated user to execute code with elevated privileges during installation of an application. Rated high severity (CVSS 7.0), this vulnerability is low attack complexity. No vendor patch available.
An improper default permission vulnerability was reported in Lenovo Dock Manager that, under certain conditions during installation, could allow an authenticated local user to redirect log files with. Rated medium severity (CVSS 5.2), this vulnerability is low attack complexity. No vendor patch available.
An arbitrary file upload vulnerability was reported in the Lenovo Scanner Pro client during an internal security assessment that could allow remote code execution or unauthorized control of the. Rated high severity (CVSS 7.7), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
A vulnerability was reported in the Lenovo Scanner pro application during an internal security assessment that, under certain circumstances, could allow an attacker on the same logical network to. Rated medium severity (CVSS 6.0), this vulnerability is no authentication required. No vendor patch available.
A potential vulnerability was reported in the Lenovo PC Manager, Lenovo App Store, Lenovo Browser, and Lenovo Legion Zone client applications that, under certain conditions, could allow an attacker. Rated high severity (CVSS 7.7), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
A potential vulnerability was reported in some Lenovo Tablets that could allow a local authenticated user or application to gain access to sensitive device specific information. Rated medium severity (CVSS 6.8), this vulnerability is low attack complexity. No vendor patch available.
A null pointer dereference in the Lenovo Power Management Driver on Windows allows a local, authenticated low-privilege user to crash the machine into a blue screen (BSOD), producing a denial of service confined to that single host. Tracked as CVE-2025-9548 with a Lenovo-assigned CVSS 6.8 (CWE-476), it requires an existing account on a Lenovo system where the driver is installed; the CVSS 4.0 vector (AV:L/PR:L/UI:N, VC:N/VI:N/VA:H) confirms no privilege gain, no data exposure, and no cross-system effect. No public exploit code has been identified and there is no confirmed active exploitation (EPSS roughly 0.12%, 2nd percentile), consistent with an independent assessment that this is a genuine but low-priority issue.
Improper TLS server certificate validation in the Lenovo Universal Device Client (UDC) lets an attacker who already holds a man-in-the-middle position on the network path observe application metadata - device information, geolocation, and telemetry - flowing between the client and its backend. The attacker must be able to intercept traffic and present a forged or substituted server certificate, which corresponds to the assessed vector CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N (adjacent network, high complexity, no authentication required, confidentiality-only impact). There is no integrity or availability impact and no credential or full-data compromise indicated; EPSS is 0.09% (0th percentile) and no public exploit code or CISA KEV entry is associated with this issue, so the practical risk is low and the attack is opportunistic in nature.
Improper TLS certificate validation in the Lenovo LeCloud client application (CWE-295) can disclose information to an attacker who already occupies a man-in-the-middle position on the network path between the client and Lenovo's cloud service. The flaw is unauthenticated from the attacker's perspective (CVSS 4.0 PR:N) but is gated by attack requirements (AT:P) and passive user interaction (UI:P), meaning the victim must actually be running the client so it initiates the vulnerable connection; impact is confined to confidentiality loss only, with no integrity or availability effect. As of this analysis there is no public exploit code and no evidence of confirmed active exploitation (not in CISA KEV), and EPSS is low at 0.26% (16th percentile), so it should be treated as a low-to-moderate priority rather than an emergency.
Local privilege escalation in Lenovo PC Manager allows an authenticated low-privileged user to execute arbitrary code with elevated privileges via DLL hijacking (CWE-427). The attacker must write a malicious DLL into a directory within the application's DLL search order, requiring prior local access to the system. No public exploit identified at time of analysis (EPSS 0.15%, 4th percentile), and remote or unauthenticated exploitation is not possible.
In the Linux kernel, the following vulnerability has been resolved: usb: ucsi_acpi: Increase the command completion timeout Commit 130a96d698d7 ("usb: typec: ucsi: acpi: Increase command completion. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. This NULL Pointer Dereference vulnerability could allow attackers to crash the application by dereferencing a null pointer.
In the Linux kernel, the following vulnerability has been resolved: power: supply: bq25890: Fix external_power_changed race bq25890_charger_external_power_changed() dereferences bq->charger, which. Rated medium severity (CVSS 4.7).
A potential vulnerability was reported in the Lenovo Wallpaper Client that could allow arbitrary code execution under certain conditions. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Improper authorization in Lenovo Baiying PC Client - software distributed exclusively in the Chinese market - lets a local, already-authenticated user execute arbitrary code with elevated privileges, resulting in high impact to confidentiality, integrity, and availability. The vendor rates it 7.0 under CVSS 4.0 (CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N), and our independent CVSS 3.1 assessment is consistent: the vector is strictly local (AV:L), requires a valid logged-in session (PR:L) and some passive user interaction (UI:P), so it is not remotely triggerable. There is no public exploit identified at time of analysis and the CVE is not in CISA KEV, so real-world risk is concentrated in Chinese-market endpoints where a low-privileged local user has interactive access.
Multiple Lenovo consumer tablets - including the Idea Tab Pro (TB373FU), Idea Tab / Lenovo Tab K11 Gen 2 (TB336FU/TB336ZU), Tab M11 (TB330FU/TB330XU), Legion Tab 8.8" Gen 3 (TB321FU), Tab Extreme (TB570FU/TB570ZU), and a broader set of Tab and Yoga Tab models - contain a physical-access authentication bypass (CWE-288) that lets someone in direct possession of the device defeat the lock/authentication flow and gain unauthorized access to the device and its data. Rated 7.0 under CVSS 4.0 (AV:P/AC:L/AT:N/PR:N/UI:N with high confidentiality, integrity and availability impact), the issue requires no credentials (PR:N) and no user interaction (UI:N), so the decisive limiting factor is the Physical attack vector: there is no remote or adjacent-network exposure and only lost, stolen or unattended units are at risk. No public exploit code has been identified at time of analysis, and the specific alternate authentication path involved has not been disclosed by the vendor.
Arbitrary code execution in the Lenovo Legion Zone application allows an attacker positioned on the same logical network (shared LAN or Wi-Fi segment) to run code of their choosing on the affected host. Exploitation requires the attacker to already hold low-level privileges on the network (CVSS PR:L), needs no user interaction, and can affect confidentiality, integrity, and availability - reflected in the reported CVSS 4.0 base score of 8.6 (assessed as CVSS 3.1 8.2-equivalent, AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The issue is a moderate-to-high severity but realistically constrained problem, because Legion Zone is distributed exclusively in the Chinese market and the attack surface is limited to adjacent-network reachability; no public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV.
Sensitive health-data exposure in the Lenovo Health Android application (distributed exclusively in the Chinese market) stems from hardcoded credentials (CWE-798) that let an attacker access users' health-related information without legitimate authentication. Reported by Lenovo PSIRT and tracked under a single Lenovo advisory, it carries a CVSS 4.0 base of 9.3 driven by high confidentiality impact. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV.
Local privilege escalation in Lenovo Rescue and Smart Assistant (LMSA) enables a local authenticated user to execute arbitrary code with elevated privileges by exploiting a capture-and-replay authentication bypass (CWE-290) in the application's privileged service layer. The vulnerability is strictly local in scope per the CVSS 4.0 vector (AV:L/PR:L), limiting the threat to attackers who already hold a standard user account on an affected Lenovo device. Lenovo has published advisory LEN-217409 with remediation guidance; no public exploit has been identified at time of analysis.
Improper export of Android application components in Lenovo File Manager (Chinese-market distribution) enables a locally authenticated user or co-installed application to read or modify files that the application designates as protected. The root cause is CWE-926, where one or more Android components - likely a content provider or activity - are exported without enforcing the application's own authorization logic. No public exploit code exists and the vulnerability has not been added to CISA KEV; however, the CVSS 4.0 score of 8.4 reflects genuine high-impact file access if an attacker can install a companion malicious application on the target device.
Privilege escalation in the Lenovo Filez Client application allows a local authenticated user to gain elevated system rights via improper file or directory permissions (CWE-276). The CVSS 4.0 score of 8.5 reflects a meaningful local attack path with low complexity and no special attack requirements, though exploitation is bounded by the requirement for an existing local foothold. No active exploitation or public proof-of-concept has been identified at time of analysis.
Privilege escalation via symlink following in Lenovo Vantage and Lenovo Commercial Vantage allows a local authenticated user to execute arbitrary code with elevated privileges on affected Lenovo systems. Discovered during an internal Lenovo security assessment, the flaw (CWE-59) arises when a privileged Vantage component resolves attacker-controlled symbolic links without validation, enabling redirection of file operations to security-sensitive targets. No public exploit code or active exploitation has been confirmed at time of analysis; CVSS 4.0 scores this at 7.3 with a local attack vector and specific attack requirements present.
Privilege escalation in Lenovo Accessories and Display Manager for Enterprise for Windows allows a local authenticated user with low-level privileges to execute arbitrary code at elevated privilege levels, stemming from a hard-coded cryptographic key (CWE-321). The vulnerability was surfaced during an internal Lenovo security assessment and affects all versions of the product per the CPE wildcard. No public exploit code or CISA KEV listing is identified at time of analysis; a vendor patch is confirmed available via Lenovo advisory LEN-213038.
Privilege escalation in Lenovo Dock Manager exposes local authenticated users to full system compromise via an improperly protected cryptographic key, discovered during Lenovo's own internal security assessment. An attacker with a standard local user account can extract the weakly protected key and leverage it to elevate privileges on the affected endpoint. No public exploit has been identified at time of analysis; Lenovo has released a patch via advisory LEN-223470.
Privilege escalation in Lenovo Dock Manager allows a local authenticated user to execute arbitrary code with elevated privileges by exploiting improper file or directory permissions (CWE-276). The flaw was identified during Lenovo's own internal security assessment, suggesting proactive vendor discovery rather than external researcher or attacker-driven disclosure. No public exploit code has been identified at time of analysis, and the local-only attack vector (AV:L, PR:L) meaningfully constrains real-world exposure compared to network-exploitable vulnerabilities, though enterprise environments with shared Lenovo workstations should treat this as a genuine privilege escalation risk.
Lenovo System Update contains an authentication bypass (CWE-290) that permits a locally authenticated standard user to circumvent privilege checks and execute arbitrary code with elevated system privileges. Affected products span all tracked versions per CPE data, with Lenovo confirming the issue and releasing a patch under advisory LEN-213316. No public exploit code or CISA KEV listing has been identified at time of analysis, limiting immediate threat to environments where adversaries already have local user access.
OS command injection in Lenovo XClarity Orchestrator (LXCO) 2.2.0 enables an authenticated low-privileged attacker to execute arbitrary operating system commands with elevated privileges under a specific, undisclosed circumstance. LXCO is an enterprise data center orchestration platform that manages Lenovo server and chassis infrastructure, making successful exploitation highly impactful to infrastructure availability, integrity, and confidentiality. No public exploit code or CISA KEV listing has been identified at time of analysis; a vendor patch is available via the Lenovo advisory.
Improper TLS certificate validation in multiple Lenovo XClarity Orchestrator (LXCO) 2.2.0 microservices exposes sensitive management communications to interception by an adjacent network attacker capable of positioning themselves for a machine-in-the-middle attack. The flaw (CWE-295) allows the attacker to bypass HTTPS trust enforcement under unspecified triggering circumstances, potentially capturing credentials, tokens, or orchestration data exchanged between LXCO microservices. No public exploit code or CISA KEV listing exists at time of analysis; Lenovo has released a patch via advisory HT509976.
PowerShell command injection in Lenovo XClarity Integrator for Microsoft Windows Admin Center (versions 5.1.1 and below) running on the WAC Gateway allows an authenticated low-privileged attacker to inject arbitrary PowerShell commands when the plugin establishes remote PowerShell sessions. Successful exploitation yields high-impact code execution that extends beyond the plugin into subsequent systems (managed hosts), with full confidentiality, integrity, and availability compromise. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Local privilege escalation to arbitrary code execution affects Lenovo App Store, a software-distribution client shipped exclusively on Lenovo devices in the Chinese market. A local authenticated user who can interact with the application can leverage its excessive privileges (CWE-250) to run arbitrary code at an elevated privilege level, with high confidentiality, integrity, and availability impact on the host. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so no active exploitation is confirmed.
Local code execution in Lenovo App Store (Chinese-market distribution only) lets an authenticated local user abuse a path traversal weakness to write or load files outside intended directories and run arbitrary code. The flaw was self-reported by Lenovo and carries a CVSS 4.0 base score of 7.0; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. Impact is high to confidentiality, integrity, and availability of the local system, but exploitation requires existing low-privilege local access plus user interaction.
Local code execution in Lenovo Legion Zone and the Lenovo App Store (China-market Windows builds) allows an authenticated local user to run arbitrary code when either application is installed on a non-system partition. The flaw stems from insecure directory/file permissions (CWE-277) that a low-privileged user can abuse to plant or modify executable content later run with higher privilege. No public exploit is identified at time of analysis and it is not listed in CISA KEV; impact is confined to systems where these Chinese-market Lenovo utilities are deployed to a non-default drive.
Local privilege escalation in the FluxInk (formerly Sunia SPB Peripheral) Color Management Driver TcnPeripheral64.sys version 1.0.7.2 lets a standard user map arbitrary physical memory via the \Device\PhysicalMemory object and gain kernel-level control. The flaw affects Lenovo systems shipping this signed color-management driver and is fixed in version 1.0.7.6. Publicly available exploit code exists; there is no public exploit identified as actively exploited (not in CISA KEV), though the vulnerability was reported by CISA (cisa-cg).
Privilege escalation in Lenovo Smart Connect for Windows allows a local authenticated user to bypass authentication checks and execute arbitrary code with elevated privileges. The flaw stems from an authentication bypass weakness (CWE-290) in the Windows client and carries a CVSS 4.0 score of 7.3. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Local privilege escalation in Lenovo's LanSchool Classic client application allows authenticated users on affected endpoints to execute arbitrary code with elevated privileges via an uncontrolled search path (CWE-427). The flaw carries a CVSS 4.0 score of 8.5 with high impact across confidentiality, integrity, and availability, and no public exploit identified at time of analysis. Because LanSchool Classic is widely deployed in K-12 and education environments, exploitation could let a student or low-privileged user gain SYSTEM-level control of managed classroom devices.
Local privilege escalation in Lenovo Accessories and Display Manager for Enterprise on Windows allows an authenticated low-privileged user to execute arbitrary code with elevated privileges, per a Lenovo-disclosed internal finding (LEN-213623). The CVSS 4.0 base score of 8.5 reflects high impact to confidentiality, integrity, and availability of the vulnerable system, though no public exploit identified at time of analysis. The CWE-306 (Missing Authentication for Critical Function) classification combined with the 'Authentication Bypass' tag suggests a privileged operation in the product is reachable without proper access checks.
Out-of-bounds read in the Linux kernel's AppArmor LSM subsystem (security/apparmor/match.c) allows a local low-privileged user to trigger a KASAN slab-out-of-bounds read via the mount() syscall on kernels 7.0 through 7.0.3 and 7.1-rc1. The flaw stems from a missing string terminator that causes aa_dfa_match() to read past the end of an 8KB kmalloc buffer when processing mount path strings, resulting in potential information disclosure and system instability (denial of service). No public exploit identified at time of analysis, and EPSS probability is negligible at 0.02%.
Path traversal in Lenovo Personal Cloud Storage devices allows authenticated remote attackers to move or access files belonging to other users on the same device, enabling unauthorized data disclosure and modification across user boundaries. Affects multiple product lines including Personal Cloud (T1, T2, T2S, T2Pro, X1, X1S, A1, A1S) and Home Storage Hub (T20, X20). CVSS 8.6 reflects high confidentiality and integrity impact with low attack complexity. No active exploitation confirmed in CISA KEV at time of analysis, and EPSS data not available for this 2026 CVE identifier.
Remote command execution in Lenovo Personal Cloud Storage devices (T1, T2, T2S, T2Pro, X1, X1S, A1, A1S, and Home Storage Hub T20/X20) allows authenticated users on the local network to execute arbitrary commands via OS command injection (CWE-78). The CVSS v4.0 score of 8.7 reflects complete system compromise potential (VC:H/VI:H/VA:H) through network attack with low complexity but requiring low-privilege authentication (AV:N/AC:L/PR:L). No evidence of active exploitation (not in CISA KEV) or public exploit code identified at time of analysis. Lenovo has issued advisories including end-of-life notices for certain models (T1), indicating some affected products may not receive patches.
Use-after-free in Linux kernel q6apm audio driver allows local authenticated attackers with low privileges to achieve arbitrary code execution, denial of service, or information disclosure with high impact to confidentiality, integrity, and availability. The flaw affects Qualcomm ASoC q6apm component registration code used in devices like Lenovo 21N2ZC5PUS laptops. Vendor-released patches are available across multiple kernel version branches (6.12.83, 6.18.24, 6.19.14, 7.0.1). EPSS score of 0.02% (5th percentile) indicates low probability of mass exploitation despite high CVSS 7.8, with no confirmed active exploitation or public POC identified at time of analysis.
Local privilege escalation in Lenovo Software Fix versions prior to 7.5.5.19 allows an authenticated local attacker to execute arbitrary code with elevated privileges via argument injection. While the CVSS 4.0 score is 8.5, exploitation requires local authenticated access and no active exploitation or public exploit is known; EPSS probability is extremely low (0.01%).
Local privilege escalation in Lenovo Software Fix versions prior to 7.5.5.19 allows an authenticated user to execute arbitrary code with elevated privileges during installation via an uncontrolled search path (CWE-427). The vulnerability requires local access and user interaction to run the installer. No active exploitation or public exploit code is known at this time.
Improper TLS certificate validation in Lenovo Filez (Windows and Android) enables an adjacent-network attacker who can intercept application traffic to present a fraudulent certificate, inject malicious server responses, and achieve arbitrary code execution on the victim's device. Both Windows and Android clients are confirmed affected per NVD CPE data with no version upper bound specified. No public exploit code has been identified and EPSS probability is 0.01%, though the impact if exploitation succeeds is fully classified as high across confidentiality, integrity, and availability.
The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception handling and error-message generation during file-upload attempts, which allows. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Lenovo System Update (formerly ThinkVantage System Update) before 5.06.0034 uses predictable security tokens, which allows local users to gain privileges by sending a valid token with a command to. Rated high severity (CVSS 7.2), this vulnerability is low attack complexity. Public exploit code available and EPSS exploitation probability 29.6%.
Directory traversal vulnerability in the VulCore web service (WSVulnerabilityCore/VulCore.asmx) in Lenovo ThinkManagement Console 9.0.3 allows remote attackers to delete arbitrary files via a .. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 77.4%.
Unrestricted file upload vulnerability in andesk/managementsuite/core/core.anonymous/ServerSetup.asmx in the ServerSetup web service in Lenovo ThinkManagement Console 9.0.3 allows remote attackers to. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 86.5%.
Arbitrary code execution is possible on a broad set of Lenovo consumer tablets - including the Idea Tab Pro TB373FU, Idea Tab / Lenovo Tab K11 Gen 2 TB336FU and TB336ZU, Legion Tab TB321FU, Tab M11 TB330FU and TB330XU, Tab Extreme TB570FU and TB570ZU, and Tab K11 TB330FUP, with additional models enumerated in vendor tagging (Tab K11 Plus, Tab K9, Tab One, Tab P12, Tab Plus, Yoga Tab, Yoga Tab Plus, and the TB311FU/TB311XU folio and clear-case variants) - by an attacker who has physical possession of the tablet while it is already unlocked. The CVSS 4.0 base score is 5.4 (MEDIUM), with vector AV:P/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N, meaning exploitation requires the attacker to be physically at the device (AV:P), no prior privileges are needed (PR:N), no victim interaction is required beyond the device already being unlocked (UI:N), and attack requirements are present (AT:P) in the form of physical custody plus an unlocked state; the flaw affects a device's own confidentiality, integrity and availability but does not propagate to subsequent systems. No CISA KEV listing is associated with this CVE and no public exploit code has been identified at time of analysis, so real-world risk is bounded by the physical and unlocked-device preconditions - a locked, powered-off, or patched unit is not exploitable via this issue.
An out-of-bounds write in the Lenovo Energy Management kernel-mode driver lets a local authenticated user crash the affected Windows host with a blue-screen (kernel bugcheck) error, producing a denial-of-service condition on systems where the driver is installed and loaded. The flaw is availability-only: the assessed impact is kernel memory corruption leading to a crash, with no demonstrated path to code execution or data disclosure, and it requires the attacker to already hold a local session on the machine (PR:L) - there is no network-reachable attack surface. No public exploit code and no evidence of active exploitation were identified at time of analysis, so this should be treated as a moderate-severity, patch-and-move-on item rather than an emergency; the vendor advisory is Lenovo LEN-218444.
Sensitive information disclosure in Lenovo Smart Camera C33 - and the related C33 Pro, C35, RQ3, XW1, X6T, X6Q and Smart Network PTZ X5T/X5Q/X5E models - allows an attacker who is already positioned on the same adjacent network segment to read confidential data from the device without authenticating or relying on user interaction. The root cause class (CWE-1393, use of default password) points to weak or default credentials or secrets as the disclosure vector, and the CVSS v4.0 vector carries an AT:P precondition, meaning specific device state or configuration conditions must also hold, so this is not a direct internet-facing exploit. Exploitation is further limited because these cameras were distributed exclusively in the Chinese market; no public exploit code has been identified at time of analysis, and the independently assessed severity is a moderate, context-dependent risk rather than a top-tier emergency.
Improper TLS certificate validation in Lenovo Smart Camera firmware lets a network-adjacent attacker who has already established a man-in-the-middle position on the same local or Wi-Fi segment intercept the camera's network communications and read the traffic it protects. Unauthenticated attackers are sufficient (PR:N), and only the victim's ordinary camera or companion-app activity is required for capture (passive user interaction), with high confidentiality impact but no availability impact. Affected devices include the Smart Camera C33, C33 Pro, C35, RQ3, XW1, X6T, X6Q, C5X and X9T plus the Smart Network PTZ X5T, X5Q and X5E, all sold exclusively in the Chinese market, which sharply narrows the realistic target population. No public exploit identified at time of analysis and no CISA KEV listing; at CVSS 4.0 base 5.9 this is a medium-severity, low real-world priority issue rather than an urgent one, consistent with the requirement to first obtain an adjacent MITM position and with the absence of internet-facing exposure.
In the Linux kernel, the following vulnerability has been resolved: clk: qcom: camcc-sc8280xp: unregister CAMCC_GDSC_CLK With the introduction of sync_state support in the clk and pmdomain subsystems, the following warning happens when the unused clocks are shutdown in camcc-sc8280xp: [ 15.408367] titan_top_gdsc status stuck at 'on' [ 15.408429] WARNING: drivers/clk/qcom/gdsc.c:178 at gdsc_toggle_logic+0x14c/0x160, CPU#2: kworker/u32:1/14 [ 15.408462] Modules linked in: bnep vfat fat ath11k_pci(+) ath11k mac80211 cfg80211 mhi libarc4 snd_soc_wcd938x snd_soc_wcd938x_sdw snd_soc_wcd_classh hci_uart snd_soc_wcd_common snd_soc_sc8280xp soundwire_qcom snd_soc_wcd_mbhc snd_soc_qcom_sdw slimbus snd_soc_qcom_common regmap_sdw btqca btrtl qcom_camss soundwire_bus btbcm btintel snd_soc_sdca snd_soc_lpass_wsa_macro bluetooth snd_soc_lpass_tx_macro snd_soc_lpass_va_macro snd_soc_lpass_rx_macro snd_soc_hdmi_codec snd_soc_lpass_macro_common videobuf2_dma_sg ov5675 v4l2_fwnode videobuf2_memops qcom_spmi_adc5 snd_soc_core qcom_spmi_adc_tm5 videobuf2_v4l2 snd_seq snd_seq_device videobuf2_common v4l2_async qcom_vadc_common qcom_spmi_temp_alarm pm8941_pwrkey industrialio videodev snd_compress rfkill ac97_bus snd_pcm_dmaengine qcom_tsens mc qcom_edac snd_pcm pci_pwrctrl_pwrseq qcom_cpufreq_hw snd_timer snd qcomtee soundcore tee leds_gpio joydev binfmt_misc zram lz4hc_compress governor_simpleondemand panel_edp msm xhci_plat_hcd nvme nvme_core dwc3 qcom_pm8008_regulator [ 15.408688] ucsi_glink nvme_keyring nvme_auth pmic_glink_altmode udc_core typec_ucsi aux_hpd_bridge qcom_battmgr ulpi ubwc_config socinfo ocmem drm_gpuvm qcom_q6v5_pas drm_exec qcom_pil_info leds_qcom_lpg gpu_sched led_class_multicolor rtc_pm8xxx qcom_pbs qcom_common drm_display_helper qcom_pon qcom_glink_smem qcom_glink ghash_ce pwrseq_qcom_wcn gpio_sbu_mux qcom_stats phy_qcom_qmp_combo qcom_q6v5 gf128mul cec dispcc_sc8280xp phy_qcom_edp camcc_sc8280xp i2c_qcom_cci qcom_sysmon drm_dp_aux_bus mdt_loader aux_bridge qcom_pm8008 i2c_hid_of_elan dwc3_qcom_legacy llcc_qcom icc_bwmon gpi typec qcom_refgen_regulator phy_qcom_qmp_usb nvmem_qfprom qcom_ipcc phy_qcom_snps_femto_v2 gpucc_sc8280xp pinctrl_sc8280xp_lpass_lpi qcom_hwspinlock pinctrl_lpass_lpi lpasscc_sc8280xp qrtr qcom_aoss pmic_glink pdr_interface phy_qcom_qmp_pcie qcom_smd qcom_pdr_msg icc_osm_l3 qcom_wdt qmi_helpers qcom_rng smp2p rpmsg_core gpio_keys pwm_bl smem hid_multitouch fuse i2c_dev [ 15.408928] CPU: 2 UID: 0 PID: 14 Comm: kworker/u32:1 Not tainted 7.1.0+ #2 PREEMPT(lazy) [ 15.408937] Hardware name: LENOVO 21BX0016US/21BX0016US, BIOS N3HET88W (1.60 ) 03/14/2024 [ 15.408942] Workqueue: pm pm_runtime_work [ 15.408959] pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 15.408967] pc : gdsc_toggle_logic+0x14c/0x160 [ 15.408978] lr : gdsc_toggle_logic+0x14c/0x160 [ 15.408987] sp : ffff8000800f3b40 [ 15.408991] x29: ffff8000800f3b40 x28: 0000000000000000 x27: 0000000000000000 [ 15.409003] x26: 0000000000000000 x25: 0000000000000000 x24: 0000000000000000 [ 15.409014] x23: 0000000000000000 x22: 0000000000000001 x21: ffffa33f298fca88 [ 15.409024] x20: 0000000000000000 x19: ffffa33f298fc5b0 x18: 00cd15db75dacefd [ 15.409035] x17: 000000040044ffff x16: ffffa33f3b1a3d88 x15: 726f776b80000002 [ 15.409045] x14: ffffffffffffffff x13: 0000000000000028 x12: 0101010101010101 [ 15.409056] x11: 7f7f7f7f7f7f7f7f x10: fefeff3039313274 x9 : ffffa33f3a5edafc [ 15.409067] x8 : ffff8000800f3780 x7 : 0000000000000001 x6 : 0000000000000001 [ 15.409078] x5 : ffff000bf3ca1288 x4 : 0000000000000000 x3 : ffff5cccb6a3f000 [ 15.409088] x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff000080ae0000 [ 15.409098] Call trace: [ 15.409103] gdsc_toggle_logic+0x14c/0x160 (P) [ 15.409115] gdsc_disable+0x4c/0x190 [ 15.409126] _genp ---truncated---
Out-of-bounds memory access in the ELAN TrackPoint device driver on Lenovo ThinkPad and related laptops allows a local authenticated user to crash the operating system under specific conditions, resulting in a denial-of-service. Disclosed by Lenovo via advisory LEN-213604, the vulnerability spans a very large number of ThinkPad model lines running Windows 10 and Windows 11. No public exploit code has been identified and the vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog, consistent with its local-only, high-complexity attack profile.
Arbitrary file deletion with elevated privileges affects Lenovo Dock Manager across all tracked versions (CPE: cpe:2.3:a:lenovo:dock_manager:*:*:*:*:*:*:*:*). An authenticated local user can exploit this CWE-59 link-following flaw to redirect the application's privileged file deletion routine to arbitrary targets outside the user's permitted scope, threatening both system integrity and availability. The vulnerability was identified through Lenovo's own internal security assessment; a vendor patch is available via advisory LEN-223470, and no public exploit has been identified at time of analysis.
Arbitrary file deletion with elevated privileges is possible in the VantageCoreAddin component of Lenovo Vantage and Lenovo Commercial Vantage via an improper link following (symlink) attack. A local authenticated user operating with low privileges can exploit this to delete files outside their authorized scope by placing a malicious symbolic or hard link in a path the addin traverses with elevated rights. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
In the Linux kernel, the following vulnerability has been resolved: HID: hid-lenovo-go: cancel cfg_setup work in hid_go_cfg_remove() hid_go_cfg_probe() initialises drvdata.go_cfg_setup and schedules it to run 2 ms later: INIT_DELAYED_WORK(&drvdata.go_cfg_setup, &cfg_setup); schedule_delayed_work(&drvdata.go_cfg_setup, msecs_to_jiffies(2)); cfg_setup() dereferences drvdata.hdev to issue MCU command requests. hid_go_cfg_remove() tears down sysfs and stops the HID device, but never drains the delayed work. If the device is unbound within the 2 ms scheduling delay (a probe failure rolling back via remove, or a fast rmmod after probe), the work fires after hid_destroy_device() has dropped its reference and released the underlying hdev struct, leaving cfg_setup() with a stale drvdata.hdev pointer. Mirror the sibling driver hid-lenovo-go-s.c, whose hid_gos_cfg_remove() already calls cancel_delayed_work_sync() on its analogous work, and drain go_cfg_setup at the top of hid_go_cfg_remove(). The cancel must come before guard(mutex)(&drvdata.cfg_mutex) because cfg_setup() acquires that mutex; reversing the order would deadlock.
Insecure temporary file creation in Lenovo XClarity Essentials OneCLI 5.5.0 and earlier on Linux enables a local low-privileged attacker to overwrite or truncate arbitrary system files via a race condition (CWE-377), but only when a privileged user concurrently executes OneCLI with elevated rights. The attack timing requirement (AT:P in the vendor CVSS 4.0 vector) confirms this is a classic TOCTOU-style symlink race, limiting realistic exploitation to shared multi-user Linux environments where an administrator routinely runs the tool elevated. No public exploit code or CISA KEV listing exists; the vendor has released a patch via advisory LEN-ht116433.
Deadlock in the Linux kernel's drm/msm (Qualcomm Snapdragon GPU) shrinker causes full kernel hang under memory reclaim pressure. The circular lock dependency arises when the kswapd0 thread holds fs_reclaim and the MSM gem shrinker calls dma_resv_lock(), which internally attempts to re-acquire fs_reclaim - producing a ABBA deadlock that renders the system unresponsive. Kernels in the affected range on Snapdragon-based hardware (Linux 6.17 through pre-patch 7.0.x and 6.18.x) are vulnerable; no public exploit code exists and no active exploitation has been confirmed.
In the Linux kernel, the following vulnerability has been resolved: platform/x86: lenovo-wmi-helpers: Fix memory leak in lwmi_dev_evaluate_int() lwmi_dev_evaluate_int() leaks output.pointer when retval == NULL (found by sashiko.dev [1]). Fix it by moving `ret_obj = output.pointer' outside of the `if (retval)' block so that it is always freed by the __free cleanup callback. No functional change intended.
Lenovo BIOS firmware across dozens of consumer and gaming laptop models - Legion, IdeaPad, Yoga, ThinkBook, LOQ, and V-series - contains a missing authentication flaw in the WMI-to-SMI interface that permits a local privileged attacker to arbitrarily trigger System Management Interrupt handlers, enabling execution at the SMM firmware level below the operating system security boundary. No public exploit code has been identified at time of analysis, and CISA KEV listing is not confirmed. The practical threat is post-compromise firmware persistence: an attacker already holding OS-level administrative privileges could use this flaw to manipulate firmware behavior in ways invisible to endpoint security tools, bypassing Secure Boot or implanting persistent code in System Management Mode.
Out-of-bounds write in Lenovo BIOS firmware across dozens of consumer and gaming laptop models enables a local attacker with high OS-level privileges to execute arbitrary code in System Management Mode (SMM) - a CPU execution context operating below the operating system and hypervisor with access to all system memory. Successful exploitation allows persistent firmware-level implants that survive OS reinstallation and defeat Secure Boot and standard endpoint detection tools. No public exploit has been identified at time of analysis, and this vulnerability is not listed in CISA KEV; however, SMM code execution represents one of the highest-impact firmware attack primitives available to an advanced threat actor.
SMM memory address disclosure in Lenovo laptop BIOS firmware exposes the location of protected System Management Mode (SMRAM) regions to a local privileged attacker. Dozens of Lenovo consumer, gaming, and business laptop product lines are affected across IdeaPad, Legion, Yoga, ThinkBook, LOQ, and V-series models. While the direct impact is confidentiality-only, SMRAM address disclosure is a classic prerequisite step in firmware-level attack chains that seek to bypass address-space protections and ultimately plant persistent SMM rootkits. No public exploit has been identified at time of analysis, and exploitation is not confirmed in CISA KEV.
Out-of-bounds write in Lenovo BIOS firmware across dozens of consumer and gaming laptop models enables a local privileged attacker to corrupt power management settings within System Management Mode, a CPU execution context operating below the OS kernel at Ring -2. Successful exploitation could allow persistent firmware-level tampering that survives OS reinstalls and reboots. No public exploit has been identified at time of analysis, and exploitation requires pre-existing high OS-level privileges, substantially limiting real-world risk to post-compromise scenarios.
Lenovo Smart Connect for Windows exposes an improper access control flaw that permits a local authenticated user to read files belonging to other users on the same machine. Discovered through Lenovo's own internal security assessment and documented under advisory LEN-218281, the flaw carries a CVSS 4.0 score of 6.8 with a local, low-privilege attack vector and high confidentiality impact. No public exploit code and no CISA KEV listing exist at time of analysis, limiting immediate risk to multi-user Windows environments where Lenovo Smart Connect is installed.
NULL pointer dereference in the Linux kernel's ASoC SDCA (SoundWire Device Class for Audio) subsystem crashes the kernel during audio device cleanup, resulting in a denial of service. The `sdca_dev_unregister_functions()` routine iterates over SDCA function descriptors without validating for NULL entries, which can be present when function registration fails partway through or when device cleanup races with probe deferral. This crash was observed in practice on Lenovo ThinkPad X1 Carbon G14 (Panther Lake) systems where missing SOF firmware caused the SOF audio driver probe to fail, triggering the NULL dereference during subsequent SoundWire device teardown. No public exploit exists and EPSS sits at 0.14% (4th percentile), reflecting the hardware-specific and locally-triggered nature of this flaw.
NULL pointer dereference in the Linux kernel's ps883x USB Type-C retimer driver causes a kernel Oops during device unbind, resulting in a denial of service. The ps883x_retimer_remove() function calls i2c_get_clientdata() to retrieve driver-private state, but i2c_set_clientdata() was never called during probe, leaving the pointer NULL; dereference at offset 0x20 triggers a fatal translation fault. Systems with ps883x retimer hardware running affected kernel versions are vulnerable when a privileged local user unbinds the driver via sysfs. No active exploitation is confirmed (no CISA KEV listing), and the EPSS score of 0.17% (6th percentile) reflects negligible real-world exploitation probability.
Local privilege escalation to System Management Mode (SMM) in Lenovo ThinkPad BIOS firmware allows a high-privileged local user to execute arbitrary code at one of the most privileged execution rings on x86 hardware. The flaw, an out-of-bounds write (CWE-787) discovered by Lenovo during an internal security assessment, affects a wide range of current-generation ThinkPad models including X1 Carbon 13th Gen, X13 Gen 6, T14s Gen 6, P14s/P16v Gen 3, L13/L14/L16 Gen 6, and E16 Gen 3. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Arbitrary privileged memory read/write in Lenovo ThinkPad embedded controller (EC) firmware allows a local administrator on affected ThinkPad models (X13 Gen 6, X1 Carbon 13th Gen, P16v Gen 3, L16 Gen 1/2, T14s Gen 6, P14s Gen 6, L13 Gen 6, L14 Gen 6) to access or modify protected memory regions. Discovered during Lenovo's internal security assessment, the issue is rated CVSS 4.0 8.4 (High) and there is no public exploit identified at time of analysis, with no CISA KEV listing. Despite the high score, exploitation requires high privileges and local access, narrowing realistic abuse to attackers who already have admin on the host or to supply-chain/insider scenarios.
Clipboard hijacking in Lenovo's built-in Android browser application allows a malicious website to silently overwrite system clipboard contents on affected devices. The vulnerability impacts Lenovo Android tablets distributed exclusively in the Chinese market, enabling a network-based attacker to manipulate clipboard data when a user visits a crafted website. No confirmed active exploitation (CISA KEV) or public exploit code has been identified at time of analysis; EPSS data was not provided in available intelligence.
Kernel crash (local denial of service) in the Linux nouveau NVIDIA GPU driver allows a local authenticated user to trigger a kernel WARNING and system instability by accessing the DisplayPort AUX channel (/dev/drm_dp_*) while the GPU is in runtime-suspended state. The driver fails to check device power state before invoking the GSP (GPU System Processor) firmware communication path, causing an unhandled condition in r535_gsp_msgq_wait. No public exploit exists and the EPSS score is 0.02% (7th percentile), but the vulnerability is notable in environments where fwupd or similar firmware tools interact with DP AUX interfaces on systems using the nouveau driver with runtime power management enabled.
Kernel denial of service in rtw88 WiFi driver 8822b chipset allows local authenticated users to trigger a kernel WARNING and potential system instability by setting antenna configuration while the wireless chip is powered off, causing unexpected values when RF registers are read during power-down state.
Arbitrary file write with elevated privileges in Lenovo Software Fix installer allows local authenticated users to overwrite system files during installation. Affected versions before 7.5.5.19. No public exploitation reported, EPSS low (0.01%), and SSVC
DLL hijacking in Lenovo Service Bridge prior to version 5.0.2.20 allows a local authenticated user to execute arbitrary code with elevated privileges by planting a malicious DLL in a directory resolved before the legitimate library during application load. Confirmed by Lenovo security advisory LEN-211071 and EUVD-2026-22919, this is a CWE-427 uncontrolled search path issue confined entirely to local exploitation. No public exploit has been identified at time of analysis, and EPSS at 0.01% (2nd percentile) reflects negligible observed exploitation activity.
Arbitrary file write with elevated privileges exists in Lenovo Diagnostics and HardwareScanAddin components of Lenovo Vantage. A local authenticated user can overwrite files during installation or hardware scan, posing integrity and availability risks. No active exploitation or public exploits have been identified (EPSS 0.01%), and a vendor patch is available.
Lenovo PC Manager permits local authenticated users to terminate privileged processes due to improper privilege management, potentially disrupting system operations or enabling denial of service. An attacker with valid credentials could leverage this vulnerability to halt critical processes without administrative approval. No patch is currently available to address this issue.
LenovoProductivitySystemAddin in Lenovo Vantage and Baiying contains an input validation flaw that enables local authenticated users to terminate arbitrary processes with elevated privileges. This medium-severity vulnerability (CVSS 6.8) requires local access and valid credentials but poses a significant availability risk. No patch is currently available.
Lenovo Vantage and Baiying DeviceSettingsSystemAddin contain an input validation flaw that allows authenticated local users to delete arbitrary registry keys with elevated privileges. This vulnerability affects systems where users have local access and could enable attackers to modify system configuration or disable security controls. No patch is currently available.
Lenovo Vantage and Baiying DeviceSettingsSystemAddin contains an input validation flaw that allows authenticated local users to modify arbitrary registry keys with system-level privileges. This vulnerability could enable privilege escalation or system configuration tampering by an attacker with local access. No patch is currently available.
The Lenovo Virtual Bus driver in Smart Connect contains a divide-by-zero flaw that enables local authenticated users to trigger a system crash (blue screen). No patch is currently available, leaving affected Windows systems vulnerable to denial-of-service attacks by privileged local users.
The Lenovo Virtual Bus driver in Smart Connect contains a buffer overflow that allows local authenticated users to corrupt memory and trigger system crashes on Windows systems. This vulnerability requires valid credentials and local access, limiting exposure to users already present on affected machines. No patch is currently available to address this issue.
Lenovo Filez fails to properly validate SSL/TLS certificates, enabling network-positioned attackers to intercept encrypted communications and extract sensitive user information. The vulnerability requires an adjacent network position and specific conditions to exploit, but affects all users of the application. No patch is currently available.
A potential vulnerability was reported in the Lenovo FileZ Android application that, under certain conditions, could allow a local authenticated user to retrieve some sensitive data stored in a log file. [CVSS 2.8 LOW]
In the Linux kernel, the following vulnerability has been resolved: leds: led-class: Only Add LED to leds_list when it is fully ready Before this change the LED was added to leds_list before led_init_core() gets called adding it the list before led_classdev.set_brightness_work gets initialized.
Thinkplus Fu100 Firmware versions up to - is affected by authentication bypass by spoofing (CVSS 7.8).
Thinkplus Fu100 Firmware versions up to - is affected by cleartext transmission of sensitive information (CVSS 5.5).
Thinkplus Fu100 Firmware versions up to - is affected by missing encryption of sensitive data (CVSS 4.6).
In the Linux kernel, the following vulnerability has been resolved: usb: typec: ucsi: Handle incorrect num_connectors capability The UCSI spec states that the num_connectors field is 7 bits, and the 8th bit is reserved and should be set to zero.
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix NULL deref in debugfs odm_combine_segments When a connector is connected but inactive (e.g., disabled by desktop environments), pipe_ctx->stream_res.tg will be destroyed. Then, reading odm_combine_segments causes kernel NULL pointer dereference. BUG: kernel NULL pointer dereference, address: 0000000000000000 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 0 P4D 0 Oops: Oops: 0000 [#1] SMP NOPTI CPU: 16 UID: 0 PID: 26474 Comm: cat Not tainted 6.17.0+ #2 PREEMPT(lazy) e6a17af9ee6db7c63e9d90dbe5b28ccab67520c6 Hardware name: LENOVO 21Q4/LNVNB161216, BIOS PXCN25WW 03/27/2025 RIP: 0010:odm_combine_segments_show+0x93/0xf0 [amdgpu] Code: 41 83 b8 b0 00 00 00 01 75 6e 48 98 ba a1 ff ff ff 48 c1 e0 0c 48 8d 8c 07 d8 02 00 00 48 85 c9 74 2d 48 8b bc 07 f0 08 00 00 <48> 8b 07 48 8b 80 08 02 00> RSP: 0018:ffffd1bf4b953c58 EFLAGS: 00010286 RAX: 0000000000005000 RBX: ffff8e35976b02d0 RCX: ffff8e3aeed052d8 RDX: 00000000ffffffa1 RSI: ffff8e35a3120800 RDI: 0000000000000000 RBP: 0000000000000000 R08: ffff8e3580eb0000 R09: ffff8e35976b02d0 R10: ffffd1bf4b953c78 R11: 0000000000000000 R12: ffffd1bf4b953d08 R13: 0000000000040000 R14: 0000000000000001 R15: 0000000000000001 FS: 00007f44d3f9f740(0000) GS:ffff8e3caa47f000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000000 CR3: 00000006485c2000 CR4: 0000000000f50ef0 PKRU: 55555554 Call Trace: <TASK> seq_read_iter+0x125/0x490 ? __alloc_frozen_pages_noprof+0x18f/0x350 seq_read+0x12c/0x170 full_proxy_read+0x51/0x80 vfs_read+0xbc/0x390 ? __handle_mm_fault+0xa46/0xef0 ? do_syscall_64+0x71/0x900 ksys_read+0x73/0xf0 do_syscall_64+0x71/0x900 ? count_memcg_events+0xc2/0x190 ? handle_mm_fault+0x1d7/0x2d0 ? do_user_addr_fault+0x21a/0x690 ? exc_page_fault+0x7e/0x1a0 entry_SYSCALL_64_after_hwframe+0x6c/0x74 RIP: 0033:0x7f44d4031687 Code: 48 89 fa 4c 89 df e8 58 b3 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00> RSP: 002b:00007ffdb4b5f0b0 EFLAGS: 00000202 ORIG_RAX: 0000000000000000 RAX: ffffffffffffffda RBX: 00007f44d3f9f740 RCX: 00007f44d4031687 RDX: 0000000000040000 RSI: 00007f44d3f5e000 RDI: 0000000000000003 RBP: 0000000000040000 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000202 R12: 00007f44d3f5e000 R13: 0000000000000003 R14: 0000000000000000 R15: 0000000000040000 </TASK> Modules linked in: tls tcp_diag inet_diag xt_mark ccm snd_hrtimer snd_seq_dummy snd_seq_midi snd_seq_oss snd_seq_midi_event snd_rawmidi snd_seq snd_seq_device x> snd_hda_codec_atihdmi snd_hda_codec_realtek_lib lenovo_wmi_helpers think_lmi snd_hda_codec_generic snd_hda_codec_hdmi snd_soc_core kvm snd_compress uvcvideo sn> platform_profile joydev amd_pmc mousedev mac_hid sch_fq_codel uinput i2c_dev parport_pc ppdev lp parport nvme_fabrics loop nfnetlink ip_tables x_tables dm_cryp> CR2: 0000000000000000 ---[ end trace 0000000000000000 ]--- RIP: 0010:odm_combine_segments_show+0x93/0xf0 [amdgpu] Code: 41 83 b8 b0 00 00 00 01 75 6e 48 98 ba a1 ff ff ff 48 c1 e0 0c 48 8d 8c 07 d8 02 00 00 48 85 c9 74 2d 48 8b bc 07 f0 08 00 00 <48> 8b 07 48 8b 80 08 02 00> RSP: 0018:ffffd1bf4b953c58 EFLAGS: 00010286 RAX: 0000000000005000 RBX: ffff8e35976b02d0 RCX: ffff8e3aeed052d8 RDX: 00000000ffffffa1 RSI: ffff8e35a3120800 RDI: 0000000000000000 RBP: 0000000000000000 R08: ffff8e3580eb0000 R09: ffff8e35976b02d0 R10: ffffd1bf4b953c78 R11: 0000000000000000 R12: ffffd1bf4b953d08 R13: 0000000000040000 R14: 0000000000000001 R15: 0000000000000001 FS: 00007f44d3f9f740(0000) GS:ffff8e3caa47f000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000000 CR3: 00000006485c2000 CR4: 0000000000f50ef0 PKRU: 55555554 Fix this by checking pipe_ctx-> ---truncated---
Local privilege escalation in the Lenovo Baiying Client allows an authenticated low-privilege user to execute code with elevated privileges by abusing improperly secured files, directories, or service components of the client. Only hosts running this Lenovo client - predominantly Lenovo-managed and China-market environments - are exposed, since exploitation requires an existing account on the local machine and there is no network-reachable vector. Risk is currently low in the wider ecosystem: EPSS is 0.12% (2nd percentile), no public exploit code has been identified at time of analysis, and the issue is not listed as confirmed actively exploited (CISA KEV).
Local privilege escalation in Lenovo One Client on Windows allows an authenticated local attacker to execute code with elevated privileges via DLL hijacking (CWE-427). The attacker must write a malicious DLL to a directory searched by the application; no public exploit identified at time of analysis and EPSS is low (0.14%, 2nd percentile). The vendor rates this 8.5 (CVSS 4.0), while our independent assessment yields a CVSS 3.1 base score of 7.8 (High).
DLL hijacking in Lenovo App Store and Lenovo Browser allows a local authenticated user to execute arbitrary code with elevated privileges on Windows systems where these applications are installed. Exploitation requires the attacker to already have a low-privileged local foothold and to place a malicious DLL in a location the application searches before the legitimate library, and the vendor notes this works only 'under certain conditions'. No public exploit code or active exploitation has been identified at time of analysis, and the EPSS score is low at 0.14% (2nd percentile), though the flaw carries a high CVSS 4.0 base score of 8.5.
An improper permissions vulnerability was reported in Lenovo App Store that could allow a local authenticated user to execute code with elevated privileges during installation of an application. Rated high severity (CVSS 7.0), this vulnerability is low attack complexity. No vendor patch available.
An improper default permission vulnerability was reported in Lenovo Dock Manager that, under certain conditions during installation, could allow an authenticated local user to redirect log files with. Rated medium severity (CVSS 5.2), this vulnerability is low attack complexity. No vendor patch available.
An arbitrary file upload vulnerability was reported in the Lenovo Scanner Pro client during an internal security assessment that could allow remote code execution or unauthorized control of the. Rated high severity (CVSS 7.7), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
A vulnerability was reported in the Lenovo Scanner pro application during an internal security assessment that, under certain circumstances, could allow an attacker on the same logical network to. Rated medium severity (CVSS 6.0), this vulnerability is no authentication required. No vendor patch available.
A potential vulnerability was reported in the Lenovo PC Manager, Lenovo App Store, Lenovo Browser, and Lenovo Legion Zone client applications that, under certain conditions, could allow an attacker. Rated high severity (CVSS 7.7), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
A potential vulnerability was reported in some Lenovo Tablets that could allow a local authenticated user or application to gain access to sensitive device specific information. Rated medium severity (CVSS 6.8), this vulnerability is low attack complexity. No vendor patch available.
A null pointer dereference in the Lenovo Power Management Driver on Windows allows a local, authenticated low-privilege user to crash the machine into a blue screen (BSOD), producing a denial of service confined to that single host. Tracked as CVE-2025-9548 with a Lenovo-assigned CVSS 6.8 (CWE-476), it requires an existing account on a Lenovo system where the driver is installed; the CVSS 4.0 vector (AV:L/PR:L/UI:N, VC:N/VI:N/VA:H) confirms no privilege gain, no data exposure, and no cross-system effect. No public exploit code has been identified and there is no confirmed active exploitation (EPSS roughly 0.12%, 2nd percentile), consistent with an independent assessment that this is a genuine but low-priority issue.
Improper TLS server certificate validation in the Lenovo Universal Device Client (UDC) lets an attacker who already holds a man-in-the-middle position on the network path observe application metadata - device information, geolocation, and telemetry - flowing between the client and its backend. The attacker must be able to intercept traffic and present a forged or substituted server certificate, which corresponds to the assessed vector CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N (adjacent network, high complexity, no authentication required, confidentiality-only impact). There is no integrity or availability impact and no credential or full-data compromise indicated; EPSS is 0.09% (0th percentile) and no public exploit code or CISA KEV entry is associated with this issue, so the practical risk is low and the attack is opportunistic in nature.
Improper TLS certificate validation in the Lenovo LeCloud client application (CWE-295) can disclose information to an attacker who already occupies a man-in-the-middle position on the network path between the client and Lenovo's cloud service. The flaw is unauthenticated from the attacker's perspective (CVSS 4.0 PR:N) but is gated by attack requirements (AT:P) and passive user interaction (UI:P), meaning the victim must actually be running the client so it initiates the vulnerable connection; impact is confined to confidentiality loss only, with no integrity or availability effect. As of this analysis there is no public exploit code and no evidence of confirmed active exploitation (not in CISA KEV), and EPSS is low at 0.26% (16th percentile), so it should be treated as a low-to-moderate priority rather than an emergency.
Local privilege escalation in Lenovo PC Manager allows an authenticated low-privileged user to execute arbitrary code with elevated privileges via DLL hijacking (CWE-427). The attacker must write a malicious DLL into a directory within the application's DLL search order, requiring prior local access to the system. No public exploit identified at time of analysis (EPSS 0.15%, 4th percentile), and remote or unauthenticated exploitation is not possible.
In the Linux kernel, the following vulnerability has been resolved: usb: ucsi_acpi: Increase the command completion timeout Commit 130a96d698d7 ("usb: typec: ucsi: acpi: Increase command completion. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. This NULL Pointer Dereference vulnerability could allow attackers to crash the application by dereferencing a null pointer.
In the Linux kernel, the following vulnerability has been resolved: power: supply: bq25890: Fix external_power_changed race bq25890_charger_external_power_changed() dereferences bq->charger, which. Rated medium severity (CVSS 4.7).
A potential vulnerability was reported in the Lenovo Wallpaper Client that could allow arbitrary code execution under certain conditions. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.