System Update
Monthly
Elevation of privilege in Dell System Update (DSU) versions prior to 2.3.0.0 allows an authenticated, low-privileged local attacker to reach a privileged code path and operate at higher integrity than intended, stemming from an improper access control weakness (CWE-284, tagged by the reporter as an authentication bypass). Exploitation is conditional rather than drive-by: the attacker must already hold a local account on the endpoint (AV:L, PR:L) and a separate user interaction step (UI:R) is required to trigger the vulnerable path, so this is a post-foothold escalation scenario with no remote or network-reachable vector. CVSS 3.1 scores it 8.2 with a changed scope and high confidentiality, integrity and availability impact, but no public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV.
Privilege escalation in Dell System Update versions prior to 2.3.0.0 lets a low-privileged local attacker abuse an incorrectly secured critical resource to gain higher privileges (CVSS 8.2, CWE-732). Exploitation requires local access, a valid low-privileged account, and user interaction-most plausibly an administrator running the updater after malicious content has been staged in a writable location-so remote or unauthenticated attack is not possible. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis.
Improper certificate validation in Dell System Update (DSU) versions prior to 2.3.0.0 lets an authenticated, high-privileged attacker who can occupy a man-in-the-middle position on the update path present DSU with a forged TLS certificate and deliver a malicious update payload, which the vendor describes as leading to remote execution on the affected host. The barriers are substantial: the CVSS vector (AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H) requires high privileges, a high-complexity MITM/certificate-spoofing condition, and a user initiating or accepting an update, and the scope change (S:C) reflects impact escaping the update client into the payload it installs. No public exploit code has been identified at time of analysis and there is no CISA KEV listing, so despite the genuinely High CVSS 7.6 base score, real-world urgency is tempered by these preconditions rather than driven by observed exploitation.
Path traversal in Dell System Update (DSU) versions prior to 2.3.0.0 allows an unauthenticated remote attacker to escape the intended restricted directory when the DSU client processes crafted pathnames in update content, resulting in filesystem access. Because DSU operates with elevated privileges, exploited path traversal can escalate to arbitrary code execution as root, potentially compromising both the application and the underlying operating system. Exploitation is not automatic: the CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C) shows remote, unauthenticated reach but a mandatory user interaction step, and no public exploit code was identified at time of analysis. Dell has published a fixed release, and this is a genuinely high-priority flaw rather than merely a high-CVSS outlier.
Local privilege escalation and code execution in Dell System Update (DSU) versions prior to 2.3.0.0 allows an authenticated, low-privileged local user to supply a crafted pathname that escapes the directory DSU intends to restrict, causing the elevated DSU process to read, write, or execute content from an attacker-controlled location. Exploitation yields complete loss of confidentiality, integrity, and availability on the affected host (CVSS 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), but it is not remotely reachable and requires the attacker to already hold a local low-privileged account or code-execution foothold; no public exploit code has been identified at time of analysis, EPSS is low at 0.22% (11th percentile), and CISA's SSVC assessment rates exploitation as 'none' with automatable 'no'. Vendor-released patch: 2.3.0.0.
Lenovo System Update contains an authentication bypass (CWE-290) that permits a locally authenticated standard user to circumvent privilege checks and execute arbitrary code with elevated system privileges. Affected products span all tracked versions per CPE data, with Lenovo confirming the issue and releasing a patch under advisory LEN-213316. No public exploit code or CISA KEV listing has been identified at time of analysis, limiting immediate threat to environments where adversaries already have local user access.
Lenovo System Update (formerly ThinkVantage System Update) before 5.06.0034 uses predictable security tokens, which allows local users to gain privileges by sending a valid token with a command to. Rated high severity (CVSS 7.2), this vulnerability is low attack complexity. Public exploit code available and EPSS exploitation probability 29.6%.
An uncontrolled search path vulnerability was reported in Lenovo System Update that could allow an attacker with local access to execute code with elevated privileges. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity.
A vulnerability was reported in Lenovo System Update that could allow a local user with interactive system access the ability to execute code with elevated privileges only during the installation of. Rated high severity (CVSS 7.3), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
Dell System Update (DSU) 1.9 and earlier versions contain a denial of service vulnerability. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.
A race condition vulnerability was reported in Lenovo System Update prior to version 5.07.0106 that could allow escalation of privilege. Rated high severity (CVSS 7.0).
A denial of service vulnerability was reported in Lenovo System Update versions prior to 5.07.0088 that could allow configuration files to be written to non-standard locations. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
A denial of service vulnerability was reported in Lenovo System Update before version 5.07.0084 that could allow service log files to be written to non-standard locations. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
MapDrv (C:\Program Files\Lenovo\System Update\mapdrv.exe) In Lenovo System Update versions earlier than 5.07.0072 contains a local vulnerability where an attacker entering very large user ID or. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Lenovo System Update (formerly ThinkVantage System Update) before 5.07.0013 allows local users to submit commands to the System Update service (SUService.exe) and gain privileges by launching signed. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
Race condition in Lenovo System Update (formerly ThinkVantage System Update) before 5.06.0034 uses world-writable permissions for the update files directory, which allows local users to gain. Rated medium severity (CVSS 6.9). No vendor patch available.
Lenovo System Update (formerly ThinkVantage System Update) before 5.06.0034 does not properly validate CA chains during signature validation, which allows man-in-the-middle attackers to upload and. Rated high severity (CVSS 8.3), this vulnerability is low attack complexity. No vendor patch available.
Elevation of privilege in Dell System Update (DSU) versions prior to 2.3.0.0 allows an authenticated, low-privileged local attacker to reach a privileged code path and operate at higher integrity than intended, stemming from an improper access control weakness (CWE-284, tagged by the reporter as an authentication bypass). Exploitation is conditional rather than drive-by: the attacker must already hold a local account on the endpoint (AV:L, PR:L) and a separate user interaction step (UI:R) is required to trigger the vulnerable path, so this is a post-foothold escalation scenario with no remote or network-reachable vector. CVSS 3.1 scores it 8.2 with a changed scope and high confidentiality, integrity and availability impact, but no public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV.
Privilege escalation in Dell System Update versions prior to 2.3.0.0 lets a low-privileged local attacker abuse an incorrectly secured critical resource to gain higher privileges (CVSS 8.2, CWE-732). Exploitation requires local access, a valid low-privileged account, and user interaction-most plausibly an administrator running the updater after malicious content has been staged in a writable location-so remote or unauthenticated attack is not possible. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis.
Improper certificate validation in Dell System Update (DSU) versions prior to 2.3.0.0 lets an authenticated, high-privileged attacker who can occupy a man-in-the-middle position on the update path present DSU with a forged TLS certificate and deliver a malicious update payload, which the vendor describes as leading to remote execution on the affected host. The barriers are substantial: the CVSS vector (AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H) requires high privileges, a high-complexity MITM/certificate-spoofing condition, and a user initiating or accepting an update, and the scope change (S:C) reflects impact escaping the update client into the payload it installs. No public exploit code has been identified at time of analysis and there is no CISA KEV listing, so despite the genuinely High CVSS 7.6 base score, real-world urgency is tempered by these preconditions rather than driven by observed exploitation.
Path traversal in Dell System Update (DSU) versions prior to 2.3.0.0 allows an unauthenticated remote attacker to escape the intended restricted directory when the DSU client processes crafted pathnames in update content, resulting in filesystem access. Because DSU operates with elevated privileges, exploited path traversal can escalate to arbitrary code execution as root, potentially compromising both the application and the underlying operating system. Exploitation is not automatic: the CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C) shows remote, unauthenticated reach but a mandatory user interaction step, and no public exploit code was identified at time of analysis. Dell has published a fixed release, and this is a genuinely high-priority flaw rather than merely a high-CVSS outlier.
Local privilege escalation and code execution in Dell System Update (DSU) versions prior to 2.3.0.0 allows an authenticated, low-privileged local user to supply a crafted pathname that escapes the directory DSU intends to restrict, causing the elevated DSU process to read, write, or execute content from an attacker-controlled location. Exploitation yields complete loss of confidentiality, integrity, and availability on the affected host (CVSS 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), but it is not remotely reachable and requires the attacker to already hold a local low-privileged account or code-execution foothold; no public exploit code has been identified at time of analysis, EPSS is low at 0.22% (11th percentile), and CISA's SSVC assessment rates exploitation as 'none' with automatable 'no'. Vendor-released patch: 2.3.0.0.
Lenovo System Update contains an authentication bypass (CWE-290) that permits a locally authenticated standard user to circumvent privilege checks and execute arbitrary code with elevated system privileges. Affected products span all tracked versions per CPE data, with Lenovo confirming the issue and releasing a patch under advisory LEN-213316. No public exploit code or CISA KEV listing has been identified at time of analysis, limiting immediate threat to environments where adversaries already have local user access.
Lenovo System Update (formerly ThinkVantage System Update) before 5.06.0034 uses predictable security tokens, which allows local users to gain privileges by sending a valid token with a command to. Rated high severity (CVSS 7.2), this vulnerability is low attack complexity. Public exploit code available and EPSS exploitation probability 29.6%.
An uncontrolled search path vulnerability was reported in Lenovo System Update that could allow an attacker with local access to execute code with elevated privileges. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity.
A vulnerability was reported in Lenovo System Update that could allow a local user with interactive system access the ability to execute code with elevated privileges only during the installation of. Rated high severity (CVSS 7.3), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
Dell System Update (DSU) 1.9 and earlier versions contain a denial of service vulnerability. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.
A race condition vulnerability was reported in Lenovo System Update prior to version 5.07.0106 that could allow escalation of privilege. Rated high severity (CVSS 7.0).
A denial of service vulnerability was reported in Lenovo System Update versions prior to 5.07.0088 that could allow configuration files to be written to non-standard locations. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
A denial of service vulnerability was reported in Lenovo System Update before version 5.07.0084 that could allow service log files to be written to non-standard locations. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
MapDrv (C:\Program Files\Lenovo\System Update\mapdrv.exe) In Lenovo System Update versions earlier than 5.07.0072 contains a local vulnerability where an attacker entering very large user ID or. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Lenovo System Update (formerly ThinkVantage System Update) before 5.07.0013 allows local users to submit commands to the System Update service (SUService.exe) and gain privileges by launching signed. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
Race condition in Lenovo System Update (formerly ThinkVantage System Update) before 5.06.0034 uses world-writable permissions for the update files directory, which allows local users to gain. Rated medium severity (CVSS 6.9). No vendor patch available.
Lenovo System Update (formerly ThinkVantage System Update) before 5.06.0034 does not properly validate CA chains during signature validation, which allows man-in-the-middle attackers to upload and. Rated high severity (CVSS 8.3), this vulnerability is low attack complexity. No vendor patch available.