PT-2023-6749 · Lenovo · Lenovo System Update

Published 2023-10-10 · Updated 2023-11-16 · CVE-2023-4632

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Lenovo System Update (affected versions not specified)

Description An uncontrolled search path vulnerability was reported in Lenovo System Update that could allow an attacker with local access to execute code with elevated privileges. The issue is related to the use of an untrusted search path, which can be exploited by an attacker to gain elevated privileges.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Untrusted Search Path

Uncontrolled Search Path Element

Weakness Enumeration

CWE-426

CWE-427

Related Identifiers

BDU:2023-07537

CVE-2023-4632

Affected Products

Lenovo System Update

References · 8

• https://support.lenovo.com/us/en/product_security/LEN-135367 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-4632 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-07537 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-4632 · Security Note
• https://t.me/cybersecuritytechnologies/9277 · Telegram Post
• https://twitter.com/buaqbot/status/1717612790116970974 · Twitter Post
• https://twitter.com/Dinosn/status/1717604862274199820 · Twitter Post
• https://twitter.com/CVEnew/status/1722377152791003435 · Twitter Post