Lucene search

LenovoCVE-2016-8223

HistoryNov 29, 2016 - 8:59 p.m.

CVE-2016-8223

2016-11-2920:59:01

CWE-284

lenovo

web.nvd.nist.gov

cve-2016-8223

local privilege escalation

lenovo

system interface foundation

windows 10

nvd

CVSS2

7.2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

Percentile

5.1%

JSON

During an internal security review, Lenovo identified a local privilege escalation vulnerability in Lenovo System Interface Foundation software installed on some Windows 10 PCs where a user with local privileges could run arbitrary code with administrator level privileges.

Affected configurations

Nvd

Node

lenovosystem_interface_foundationRange≤1.0.66.0

AND

microsoftwindows_10Match-x64

microsoftwindows_10Match-x86

VendorProductVersionCPE
lenovosystem_interface_foundation*cpe:2.3:a:lenovo:system_interface_foundation:*:*:*:*:*:*:*:*
microsoftwindows_10-cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:x64:*
microsoftwindows_10-cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:x86:*

Vendor	Product	Version	CPE
lenovo	system_interface_foundation	*	cpe:2.3:a:lenovo:system_interface_foundation::::::::
microsoft	windows_10	-	cpe:2.3:o:microsoft:windows_10:-::::::x64:
microsoft	windows_10	-	cpe:2.3:o:microsoft:windows_10:-::::::x86:

CNA Affected

[
  {
    "product": "All ThinkPad, ThinkCentre, ThinkStation and Lenovo-branded systems preloaded with the Windows 10 operating system, or any system running Lenovo Companion, Lenovo Settings, or Lenovo ID.",
    "vendor": "Lenovo Group Ltd.",
    "versions": [
      {
        "status": "affected",
        "version": "1.0.66.0 and earlier"
      }
    ]
  }
]

References

www.securityfocus.com/bid/94597

support.lenovo.com/us/en/solutions/LEN_10150

CVSS2

7.2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

Percentile

5.1%

JSON

Related for CVE-2016-8223