PT-2025-6526 · Lenovo · Lenovo Vantage

Published 2025-02-11 · Updated 2025-02-12 · CVE-2024-12673

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Lenovo Vantage versions on Lenovo V Series (Gen 5) Lenovo Vantage versions on ThinkBook 14 (Gen 6, 7) Lenovo Vantage versions on ThinkBook 16 (Gen 6, 7) Lenovo Vantage versions on ThinkPad E Series (Gen 1)

Description An improper privilege vulnerability was reported in a BIOS customization feature of Lenovo Vantage on SMB notebook devices, which could allow a local attacker to elevate privileges on the system.

Recommendations For Lenovo V Series (Gen 5), consider disabling the BIOS customization feature in Lenovo Vantage until a patch is available. For ThinkBook 14 (Gen 6, 7), restrict access to the BIOS customization feature in Lenovo Vantage to minimize the risk of exploitation. For ThinkBook 16 (Gen 6, 7), avoid using the BIOS customization feature in Lenovo Vantage until the issue is resolved. For ThinkPad E Series (Gen 1), as a temporary workaround, consider disabling the Lenovo Vantage application until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-264

CWE-250

Related Identifiers

BDU:2025-11586

CVE-2024-12673

Affected Products

Lenovo Vantage

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2024-12673 · Security Note
• https://bdu.fstec.ru/vul/2025-11586 · Security Note
• https://twitter.com/CVEnew/status/1889784907565768886 · Twitter Post
• https://support.lenovo.com/us/en/product_security/LEN-183176 · Note
• https://twitter.com/CveFindCom/status/1889782135977873422 · Twitter Post
• https://support.lenovo.com/br/pt/product_security/LEN-183176 · Note