Home

Description

A SQL injection vulnerability was reported in Lenovo Vantage that could allow a local attacker to modify the local SQLite database and execute limited SQLite commands.

PUBLISHED Reserved 2025-06-18 | Published 2025-07-17 | Updated 2025-08-18 | Assigner lenovo




MEDIUM: 4.8CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

MEDIUM: 5.3CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Problem types

CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Product status

Default status
unaffected

Any version before 10.2501.20.0
affected

Default status
unaffected

Any version before 20.2506.39.0
affected

Credits

Lenovo thanks Bryan Alexander of Atredis Partners for reporting this issue. finder

References

support.lenovo.com/us/en/product_security/LEN-196648

cve.org (CVE-2025-6230)

nvd.nist.gov (CVE-2025-6230)

Download JSON