PT-2023-22973 · Lenovo · Lenovo Universal Device Client

Published 2023-08-17 · Updated 2023-08-25 · CVE-2023-3078

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Lenovo Universal Device Client (UDC) (affected versions not specified)

Description An uncontrolled search path vulnerability was reported in the Lenovo Universal Device Client (UDC) that could allow an attacker with local access to execute code with elevated privileges.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Uncontrolled Search Path Element

Weakness Enumeration

CWE-427

Related Identifiers

CVE-2023-3078

Affected Products

Lenovo Universal Device Client

References · 7

• https://support.lenovo.com/us/en/product_security/LEN-121183 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-3078 · Security Note
• https://osv.dev/vulnerability/CVE-2023-3078 · Vendor Advisory
• https://t.me/cvenotify/56785 · Telegram Post
• https://t.me/cibsecurity/68766 · Telegram Post
• https://twitter.com/CVEnew/status/1692223444484817029 · Twitter Post
• https://twitter.com/cracbot/status/1692416132492427726 · Twitter Post