Lucene search

LenovoCVE-2019-6165

HistoryAug 19, 2019 - 3:15 p.m.

CVE-2019-6165

2019-08-1915:15:11

CWE-426

lenovo

web.nvd.nist.gov

cve-2019-6165

dll search path

vulnerability

paperdisplay hotkey service

privilege escalation

lenovo

night light

windows 10

CVSS2

4.4

Attack Vector

LOCAL

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:L/AC:M/Au:N/C:P/I:P/A:P

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

AI Score

7.6

Confidence

High

EPSS

0.001

Percentile

27.2%

JSON

A DLL search path vulnerability was reported in PaperDisplay Hotkey Service version 1.2.0.8 that could allow privilege escalation. Lenovo has ended support for PaperDisplay Hotkey software as the Night light feature introduced in Windows 10 Build 1703 provides similar features.

Affected configurations

Nvd

Node

lenovoyoga_700-11isk_firmwareMatch-

AND

lenovoyoga_700-11iskMatch-

Node

lenovoyoga_700-14isk_firmwareMatch-

AND

lenovoyoga_700-14iskMatch-

VendorProductVersionCPE
lenovoyoga_700-11isk_firmware-cpe:2.3:o:lenovo:yoga_700-11isk_firmware:-:*:*:*:*:*:*:*
lenovoyoga_700-11isk-cpe:2.3:h:lenovo:yoga_700-11isk:-:*:*:*:*:*:*:*
lenovoyoga_700-14isk_firmware-cpe:2.3:o:lenovo:yoga_700-14isk_firmware:-:*:*:*:*:*:*:*
lenovoyoga_700-14isk-cpe:2.3:h:lenovo:yoga_700-14isk:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
lenovo	yoga_700-11isk_firmware	-	cpe:2.3:o:lenovo:yoga_700-11isk_firmware:-:::::::*
lenovo	yoga_700-11isk	-	cpe:2.3:h:lenovo:yoga_700-11isk:-:::::::*
lenovo	yoga_700-14isk_firmware	-	cpe:2.3:o:lenovo:yoga_700-14isk_firmware:-:::::::*
lenovo	yoga_700-14isk	-	cpe:2.3:h:lenovo:yoga_700-14isk:-:::::::*

CNA Affected

[
  {
    "product": "PaperDisplay Hotkey Service",
    "vendor": "Lenovo",
    "versions": [
      {
        "lessThanOrEqual": "1.2.0.8",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

References

support.lenovo.com/solutions/LEN-27569

CVSS2

4.4

Attack Vector

LOCAL

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:L/AC:M/Au:N/C:P/I:P/A:P

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

AI Score

7.6

Confidence

High

EPSS

0.001

Percentile

27.2%

JSON

Related for CVE-2019-6165