CVE-2022-0354

High

A vulnerability was reported in Lenovo System Update that could allow a local user with interactive system access the ability to execute…

lenovo·NVD-CWE-noinfo·Published 2022-04-22

CVSS

7.8

EPSS

0.00

KEV

Exploits

cve.orgen

288 chars

A vulnerability was reported in Lenovo System Update that could allow a local user with interactive system access the ability to execute code with elevated privileges only during the installation of a System Update package released before 2022-02-25 that displays a command prompt window.

NVDen

288 chars

NVDes

326 chars

Se ha informado de una vulnerabilidad en Lenovo System Update que podría permitir a un usuario local con acceso interactivo al sistema la capacidad de ejecutar código con altos privilegios sólo durante la instalación de un paquete de System Update publicado antes del 25-02-2022, que muestra una ventana de símbolo del sistema

CVSS metrics across sources

Version	Type	Source	Base	Exp	Impact	Vector
2.0	Primary	NVD	7.2	3.9	10.0	AV:L/AC:L/Au:N/C:C/I:C/A:C
3.1	Primary	NVD	7.8	1.8	5.9	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
3.1	Primary	cve.org	7.3	—	—	CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
3.1	Primary	cve.org	7.3	—	—	CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
3.1	Secondary	NVD	7.3	1.3	5.9	CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H