Lenovo System Update Search Path CVE-2023-4632 Enables Local Priv Escalation
CVE-2023-4632 Published on November 8, 2023

An uncontrolled search path vulnerability was reported in Lenovo System Update that could allow an attacker with local access to execute code with elevated privileges.

NVD

Vulnerability Analysis

CVE-2023-4632 is exploitable with local system access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to be very high.

Attack Vector:
LOCAL
Attack Complexity:
LOW
Privileges Required:
LOW
User Interaction:
NONE
Scope:
UNCHANGED
Confidentiality Impact:
HIGH
Integrity Impact:
HIGH
Availability Impact:
HIGH

Weakness Type

What is a DLL preloading Vulnerability?

The product uses a fixed or controlled search path to find resources, but one or more locations in that path can be under the control of unintended actors.

CVE-2023-4632 has been classified to as a DLL preloading vulnerability or weakness.


Products Associated with CVE-2023-4632

Want to know whenever a new CVE is published for Lenovo System Update? stack.watch will email you.

Lenovo System Update
 

Affected Versions

Lenovo System Update Version Versions prior to 5.08.02.25 is affected by CVE-2023-4632

Exploit Probability

EPSS
0.07%
Percentile
21.15%

EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.