TI-2022-04173 Aliases CVE-2022-4569 GHSA-mxpr-25c4-rq7w

Incorrect default permissions in Lenovo ThinkPad Hybrid USB-C with USB-A Dock Firmware…

LOW 35CWE-276Published 2023-06-05 · Updated 2025-01-08

Key facts

Attack vector: Local
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

A local privilege escalation vulnerability in the ThinkPad Hybrid USB-C with USB-A Dock Firmware Update Tool could allow an attacker with local access to execute code with elevated privileges during the package upgrade or installation.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00193 9th percentileScored 2026-11-07

Fix Fixed ThinkPad Hybrid USB-C with USB-A Dock Firmware Update Tool (Lenovo): v1.0.35_v2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Lenovo	ThinkPad Hybrid USB-C with USB-A Dock Firmware Update Tool	before v1.0.35_v2	v1.0.35_v2	Patch available	CNA

ThinkPad Hybrid USB-C with USB-A Dock Firmware Update Tool VendorLenovo Affected before v1.0.35_v2 Fixed in v1.0.35_v2 Patch available CNA

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:o:lenovo:thinkpad_hybrid_usb-c_with_usb-a_dock_firmware::::::windows::*	before 1.0.35_v2	Vulnerable	Lenovo
cpe:2.3:h:lenovo:thinkpad_hybrid_usb-c_with_usb-a_dock:-:::::::*	not specified by NVD	Running on	Lenovo

cpe:2.3:o:lenovo:thinkpad_hybrid_usb-c_with_usb-a_dock_firmware:*:*:*:*:*:windows:*:* Versions before 1.0.35_v2 Vulnerable ·Lenovo
cpe:2.3:h:lenovo:thinkpad_hybrid_usb-c_with_usb-a_dock:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo

Remediation

Fix · CNA ThinkPad Hybrid USB-C with USB-A Dock Firmware Update Tool (Lenovo) Fixed in v1.0.35_v2

Timeline

2026-10-02 Threatist record created from CVE-2022-4569
2026-10-03 Alias added: GHSA-mxpr-25c4-rq7w

References

Advisory 1

https://support.lenovo.com/us/en/product_security/LEN-103544

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences