Service Bridge
Monthly
We need to generate a JSON object for CVE-2026-1636. All fields must be plain text strings. Use all provided data: EPSS, KEV not mentioned (so not in KEV), tags, CPE, CVSS 4.0 vector, SSVC, etc. First, understand the vulnerability: "potential DLL hijacking vulnerability was reported in Lenovo Service Bridge that, under certain conditions, could allow a local authenticated user to execute code with elevated privileges." CWE-427: Uncontrolled Search Path Element (DLL hijacking). CVSS 4.0: AV:L/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. That is local, low attack complexity, Attack Requirements: P (present? AT:P means attack requirements present, maybe specific conditions), Privileges Required: Low, User Interaction: Passive (UI:P means limited user interaction, e.g., user must open a file or perform some action). Impact: High on vulnerable system confidentiality, integrity, availability; no impact on subsequent system. This matches the description: local authenticated user, elevated privileges. The vector indicates PR:L, so authenticated. AT:P suggests there are some attack requirements beyond just running code, like needing to place a DLL in a specific path or something. EPSS 0.01%, percentile 2%, very low exploitation probability. SSVC: exploitation: none, automatable: no, technical impact: total. So not currently exploited, not automatable, total impact if exploited. Patch available, affected versions: Service Bridge 0 <5.0.2.20 (from EUVD). So fix version is 5.0.2.20 or later. Reference: Lenovo advisory LEN-211071. So we have exact patch. Now, fields: product_name: "Lenovo Service Bridge" (3 words) summary: Synthesize a 2-3 sentence plain-language summary, not copying description. Start with impact verb and product. For example: "Elevation of privilege in Lenovo Service Bridge allows a local authenticated user to execute code with elevated privileges via DLL hijacking." Then mention who is affected (Lenovo Service Bridge prior to 5.0.2.20), and that p
A vulnerability reported in Lenovo Service Bridge before version 4.1.0.1 could allow unencrypted downloads over FTP. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A vulnerability reported in Lenovo Service Bridge before version 4.1.0.1 could allow remote code execution. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A vulnerability reported in Lenovo Service Bridge before version 4.1.0.1 could allow remote code execution. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A vulnerability reported in Lenovo Service Bridge before version 4.1.0.1 could allow cross-site request forgery. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
We need to generate a JSON object for CVE-2026-1636. All fields must be plain text strings. Use all provided data: EPSS, KEV not mentioned (so not in KEV), tags, CPE, CVSS 4.0 vector, SSVC, etc. First, understand the vulnerability: "potential DLL hijacking vulnerability was reported in Lenovo Service Bridge that, under certain conditions, could allow a local authenticated user to execute code with elevated privileges." CWE-427: Uncontrolled Search Path Element (DLL hijacking). CVSS 4.0: AV:L/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. That is local, low attack complexity, Attack Requirements: P (present? AT:P means attack requirements present, maybe specific conditions), Privileges Required: Low, User Interaction: Passive (UI:P means limited user interaction, e.g., user must open a file or perform some action). Impact: High on vulnerable system confidentiality, integrity, availability; no impact on subsequent system. This matches the description: local authenticated user, elevated privileges. The vector indicates PR:L, so authenticated. AT:P suggests there are some attack requirements beyond just running code, like needing to place a DLL in a specific path or something. EPSS 0.01%, percentile 2%, very low exploitation probability. SSVC: exploitation: none, automatable: no, technical impact: total. So not currently exploited, not automatable, total impact if exploited. Patch available, affected versions: Service Bridge 0 <5.0.2.20 (from EUVD). So fix version is 5.0.2.20 or later. Reference: Lenovo advisory LEN-211071. So we have exact patch. Now, fields: product_name: "Lenovo Service Bridge" (3 words) summary: Synthesize a 2-3 sentence plain-language summary, not copying description. Start with impact verb and product. For example: "Elevation of privilege in Lenovo Service Bridge allows a local authenticated user to execute code with elevated privileges via DLL hijacking." Then mention who is affected (Lenovo Service Bridge prior to 5.0.2.20), and that p
A vulnerability reported in Lenovo Service Bridge before version 4.1.0.1 could allow unencrypted downloads over FTP. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A vulnerability reported in Lenovo Service Bridge before version 4.1.0.1 could allow remote code execution. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A vulnerability reported in Lenovo Service Bridge before version 4.1.0.1 could allow remote code execution. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A vulnerability reported in Lenovo Service Bridge before version 4.1.0.1 could allow cross-site request forgery. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.