PT-2023-7092 · Microsoft+1 · Autopilot+1

CVE-2023-4706 · Published 2023-10-10 · Updated 2023-11-22

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Lenovo preloaded devices (affected versions not specified)

Description A privilege escalation issue was reported due to incorrect default privileges in Lenovo preloaded devices deployed using Microsoft AutoPilot under a standard user account. This could allow an attacker to elevate their privileges.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Incorrect Default Permissions

Weakness Enumeration

CWE-276

Related Identifiers

BDU:2023-08119

CVE-2023-4706

Affected Products

Lenovo Preloaded Devices

Autopilot

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2023-4706 · Security Note
• https://support.lenovo.com/us/en/product_security/LEN-127385 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-08119 · Security Note
• https://learn.microsoft.com/en-us/troubleshoot/windows-client/shell-experience/standard-user-cannot-run-commnad-via-runonce · Note
• https://twitter.com/CVEnew/status/1722377151805272103 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1722401909049291085 · Twitter Post