Lenovo Dock Manager Local Auth Priv Esc via Improper Key Protection
CVE-2026-63424 Published on August 13, 2026
During an internal security assessment, an improperly protected key was discovered in Lenovo Dock Manager that could allow a local authenticated user to escalate privileges.
Vulnerability Analysis
CVE-2026-63424 is exploitable with local system access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity and availability.
Weakness Type
Weak Encoding for Password
Obscuring a password with a trivial encoding does not protect the password. Password management issues occur when a password is stored in plaintext in an application's properties or configuration file. A programmer can attempt to remedy the password management problem by obscuring the password with an encoding function, such as base 64 encoding, but this effort does not adequately protect the password.
Products Associated with CVE-2026-63424
Want to know whenever a new CVE is published for Lenovo Dock Manager? stack.watch will email you.
Affected Versions
Lenovo Dock Manager:- Before 1.6.5.3 is affected.