An improper validation vulnerability was reported in Lenovo Vantage that under certain conditions could allow a local attacker to execute code with elevated permissions by modifying specific registry locations.
CVSS 4.0HIGH 8.5·Local·Low privileges·No interaction·EPSS 0.00206·Published 2025-07-17·Fixed in 10.2501.20.0, 20.2506.39.0CWE-88
An improper validation vulnerability was reported in Lenovo Vantage that under certain conditions could allow a local attacker to execute code with elevated permissions by modifying an application configuration file.
CVSS 4.0HIGH 8.5·Local·Low privileges·No interaction·EPSS 0.00206·Published 2025-07-17·Fixed in 10.2501.20.0, 20.2506.39.0CWE-88
A privilege escalation vulnerability was reported in Lenovo Vantage that could allow a local attacker to bypass integrity checks and execute arbitrary code with elevated privileges.
CVSS 3.1HIGH 7.8·Local·Low privileges·No interaction·EPSS 0.00171·Published 2024-01-19·Fixed in 4.0.49.0CWE-295
A privilege escalation vulnerability was reported in LenovoBatteryGaugePackage for Lenovo System Interface Foundation bundled in Lenovo Vantage prior to version 10.2003.10.0 that could allow an authenticated user to exec…
CVSS 3.1HIGH 7.8·Local·Low privileges·No interaction·EPSS 0.00369·Published 2020-04-14·Fixed in 10.2003.10.0CWE-428
A privilege escalation vulnerability was reported in Lenovo Vantage that could allow a local attacker with physical access to impersonate Lenovo Vantage Service and execute arbitrary code with elevated privileges.
CVSS 3.1MEDIUM 6.8·Physical·No auth·No interaction·EPSS 0.00188·Published 2024-01-19·Fixed in 4.0.49.0CWE-290
An input validation vulnerability was reported in the DeviceSettingsSystemAddin used in Lenovo Vantage and Lenovo Baiying that could allow a local authenticated user to delete arbitrary registry keys with elevated privil…
CVSS 4.0MEDIUM 6.9·Local·Low privileges·No interaction·EPSS 0.00171·Published 2026-03-11·Fixed in 1.0.8.15CWE-88
An input validation vulnerability was reported in the DeviceSettingsSystemAddin used in Lenovo Vantage and Lenovo Baiying that could allow a local authenticated user to modify arbitrary registry keys with elevated privil…
CVSS 4.0MEDIUM 6.9·Local·Low privileges·No interaction·EPSS 0.00171·Published 2026-03-11·Fixed in 1.0.8.15CWE-88
An input validation vulnerability was reported in the LenovoProductivitySystemAddin used in Lenovo Vantage and Lenovo Baiying that could allow a local authenticated user to terminate arbitrary processes with elevated pri…
CVSS 4.0MEDIUM 6.8·Local·Low privileges·No interaction·EPSS 0.00167·Published 2026-03-11·Fixed in 1.0.0.138CWE-88
A SQL injection vulnerability was reported in Lenovo Vantage that could allow a local attacker to modify the local SQLite database and execute limited SQLite commands.
CVSS 4.0MEDIUM 4.8·Local·Low privileges·No interaction·EPSS 0.00171·Published 2025-07-17·Fixed in 10.2501.20.0, 20.2506.39.0CWE-89
A vulnerability was reported in Lenovo Vantage prior to version 10.2003.10.0 that could allow an authenticated user to read files on the system with elevated privileges.
CVSS 3.1MEDIUM 4.4·Local·Low privileges·User interaction·EPSS 0.00273·Published 2020-04-14·Fixed in 10.2003.10.0CWE-200