PT-2026-2958 · Lenovo · Lenovo Vantage

Published 2026-01-14 · Updated 2026-03-11 · CVE-2025-13154

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Lenovo Vantage SmartPerformanceAddin versions prior to 1.1.0.1111

Description An improper link following issue exists in the SmartPerformanceAddin for Lenovo Vantage. This allows an authenticated local user to perform arbitrary file deletion with elevated privileges, potentially leading to full system control. The issue involves a function that clears the system with SYSTEM privileges, deleting the contents of the C:WindowsTemp directory without sufficient validation. An attacker can place a symbolic link or junction point in this directory, causing the deletion process to affect arbitrary files and folders outside of Temp when executed with SYSTEM privileges. The vulnerability allows for privilege escalation to SYSTEM level without requiring complex techniques. The vulnerability was discovered through collaboration between John Ostrowski (Compass Security) and Manuel Kiesel (Cyllective AG).

Recommendations Update SmartPerformanceAddin to version 1.1.0.1111 or later.

Fix

LPE

Link Following

Weakness Enumeration

CWE-59

Related Identifiers

CVE-2025-13154

Affected Products

Lenovo Vantage

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2025-13154 · Security Note
• https://twitter.com/cyllective/status/2012520180782375276 · Twitter Post
• https://t.me/poxek/5917 · Telegram Post
• https://twitter.com/cyllective/status/2031668668363383019 · Twitter Post
• https://support.lenovo.com/us/en/product_security/LEN-208293 · Note
• https://twitter.com/compasssecurity/status/2021140260676104564 · Twitter Post
• https://twitter.com/cyllective/status/2012162629431615568 · Twitter Post
• https://twitter.com/CVEnew/status/2011759595874648118 · Twitter Post