Read the docs
TI-2016-06787 Aliases CVE-2016-8235GHSA-7vp9-w5w6-758h

Access control flaw in Lenovo Customer Care Software Development Kit

Priority LOW 34CWE-264Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-264.

Summary

Privilege escalation in Lenovo Customer Care Software Development Kit (CCSDK) versions earlier than 2.0.16.3 allows local users to execute code with elevated privileges.

Why it matters now

EPSS 0.00417 36th percentileScored 2026-11-07
Fix Fixed Customer Care Software Development Kit (CCSDK) (Lenovo Group Ltd.): 2.0.16.3

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
LenovoCustomer Care Software Development Kit (CCSDK)before 2.0.16.32.0.16.3Patch availableCNA
  • Customer Care Software Development Kit (CCSDK) VendorLenovo Affected before 2.0.16.3 Fixed in 2.0.16.3 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:lenovo:customer_care_software_development_kit:*:*:*:*:*:*:*:*up to 2.0.16VulnerableLenovo
  • cpe:2.3:a:lenovo:customer_care_software_development_kit:*:*:*:*:*:*:*:* Versions up to 2.0.16 Vulnerable ·Lenovo

Remediation

  • Fix · CNA Customer Care Software Development Kit (CCSDK) (Lenovo Group Ltd.) Fixed in 2.0.16.3

Timeline

  1. 2026-10-02 Threatist record created from CVE-2016-8235
  2. 2026-10-03 Alias added: GHSA-7vp9-w5w6-758h

References

Advisory 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences