PT-2024-1558 · Lenovo · Lenovo Vantage

Published 2024-01-09 · Updated 2024-01-26 · CVE-2023-6044

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Lenovo Vantage (affected versions not specified)

Description A privilege escalation issue was reported that could allow a local attacker with physical access to impersonate Lenovo Vantage Service and execute arbitrary code with elevated privileges. The vulnerability is related to authentication bypass via spoofing, which may enable an attacker to execute arbitrary code with elevated privileges.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Authentication Bypass by Spoofing

Weakness Enumeration

CWE-290

Related Identifiers

BDU:2024-01103

CVE-2023-6044

Affected Products

Lenovo Vantage

References · 7

• https://support.lenovo.com/us/en/product_security/LEN-144736 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-6044 · Security Note
• https://osv.dev/vulnerability/CVE-2023-6044 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-01103 · Security Note
• https://t.me/cvenotify/68850 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1748458632679731393 · Twitter Post
• https://twitter.com/CVEnew/status/1748442361670328506 · Twitter Post