CVE-2025-6232 | THREATINT

Description

An improper validation vulnerability was reported in Lenovo Vantage that under certain conditions could allow a local attacker to execute code with elevated permissions by modifying specific registry locations.

Reserved 2025-06-18 | Published 2025-07-17 | Updated 2025-07-17 | Assigner lenovo

HIGH: 8.5CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

HIGH: 7.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Problem types

CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')

Product status

Default status

unaffected

Any version before 10.2501.20.0

affected

Default status

unaffected

Any version before 20.2506.39.0

affected

Credits

Lenovo thanks Bryan Alexander of Atredis Partners for reporting this issue. finder

References

support.lenovo.com/us/en/product_security/LEN-196648

cve.org (CVE-2025-6232)

nvd.nist.gov (CVE-2025-6232)

Download JSON