A DLL search path vulnerability was reported in the Lenovo HardwareScan Plugin for the Lenovo Vantage hardware scan feature prior to version 1.0.46.11 that could allow escalation of privilege.
A DLL search path vulnerability was reported in the Lenovo HardwareScan Plugin for the Lenovo Vantage hardware scan feature prior to version 1.0.46.11 that could allow escalation of privilege.
Description: CWE-427 Uncontrolled Search Path Element
Metrics
Version
Base score
Base severity
Vector
3.1
7.3
HIGH
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Version:3.1
Base score:7.3
Base severity: HIGH
Vector:
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Metrics Other Info
Impacts
CAPEC ID
Description
Solutions
Update the Lenovo HardwareScan Plugin to version 1.0.46.11.
The Lenovo HardwareScan Plugin is automatically updated by the Lenovo System Interface Foundation Service. To immediately start the update process, reboot the computer or restart the "System Interface Foundation Service" service.
To verify the Lenovo HardwareScan Plugin version:
Open File Explorer and navigate to C:\ProgramData\Lenovo\ImController\Plugins\LenovoHardwareScanPlugin\x64
Right click on LenovoHardwareScanPlugin.dll and select Properties.
Click on the Details tab.
Read the File version.
Configurations
Workarounds
Exploits
Credits
Lenovo thanks Security Advisor, Anders Kusk, Improsec ApS for reporting this issue.
A DLL search path vulnerability was reported in the Lenovo HardwareScan Plugin for the Lenovo Vantage hardware scan feature prior to version 1.0.46.11 that could allow escalation of privilege.