PT-2023-7092 · Microsoft+1 · Autopilot+1

CVE-2023-4706 · Publicado 2023-10-10 · Atualizado 2023-11-22

Positive Technologies (AI Summary)

CVSS v3.1

7.3

Alta

Vetor base

AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Lenovo preloaded devices (affected versions not specified)

Description A privilege escalation issue was reported due to incorrect default privileges in Lenovo preloaded devices deployed using Microsoft AutoPilot under a standard user account. This could allow an attacker to elevate their privileges.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Incorrect Default Permissions

Enumeração de Fraquezas

CWE-276

Identificadores relacionados

BDU:2023-08119

CVE-2023-4706

Produtos afetados

Lenovo Preloaded Devices

Autopilot

Referências · 6

• https://nvd.nist.gov/vuln/detail/CVE-2023-4706 · Nota de Segurança
• https://learn.microsoft.com/en-us/troubleshoot/windows-client/shell-experience/standard-user-cannot-run-commnad-via-runonce · Nota
• https://support.lenovo.com/us/en/product_security/LEN-127385 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/1722377151805272103 · Publicação no Twitter
• https://twitter.com/VulmonFeeds/status/1722401909049291085 · Publicação no Twitter
• https://bdu.fstec.ru/vul/2023-08119 · Nota de Segurança