Lenovo System Update vulnerabilities
16 vulnerabilities
Known vulnerabilities in Lenovo System Update, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
CVE-2018-9063lenovo group ltd.lenovo system update+1
EPSS score0.38%
MapDrv (C:\Program Files\Lenovo\System Update\mapdrv.exe) In Lenovo System Update versions earlier than 5.07.0072 contains a local vulnerability where an attacker entering very large user ID or password can overrun the program's buffer, causing undefined behaviors, such as execution of arbitrary code. No additional privilege is granted to the attacker beyond what is already possessed to run MapDrv.CVE-2015-2234lenovosystem_updateEPSS score0.27%
Race condition in Lenovo System Update (formerly ThinkVantage System Update) before 5.06.0034 uses world-writable permissions for the update files directory, which allows local users to gain privileges by writing to an update file after the signature is validated.CVE-2015-2233lenovosystem_updateEPSS score0.40%
Lenovo System Update (formerly ThinkVantage System Update) before 5.06.0034 does not properly validate CA chains during signature validation, which allows man-in-the-middle attackers to upload and execute arbitrary files via a crafted certificate.CVE-2015-2219lenovosystem_updateEPSS score4.15%
Lenovo System Update (formerly ThinkVantage System Update) before 5.06.0034 uses predictable security tokens, which allows local users to gain privileges by sending a valid token with a command to the System Update service (SUService.exe) through an unspecified named pipe.CVE-2015-7333lenovosystem_updateEPSS score0.35%
MITRE is populating this ID because it was assigned prior to Lenovo becoming a CNA. A local privilege escalation vulnerability was reported (fixed and publicly disclosed in 2015) in Lenovo System Update version 5.07.0008 and prior where the SUService.exe /type INF and INF_BY_COMPATIBLE_ID command types could allow a user to execute arbitrary code with elevated privileges.CVE-2015-7334lenovosystem_updateEPSS score0.36%
MITRE is populating this ID because it was assigned prior to Lenovo becoming a CNA. A local privilege escalation vulnerability was reported (fixed and publicly disclosed in 2015) in Lenovo System Update version 5.07.0008 and prior where the SUService.exe /type COMMAND type could allow a user to execute arbitrary code with elevated privileges.CVE-2015-7335lenovosystem_updateEPSS score0.23%
MITRE is populating this ID because it was assigned prior to Lenovo becoming a CNA. A race condition was reported (fixed and publicly disclosed in 2015) in Lenovo System Update version 5.07.0008 and prior that could allow a user to execute arbitrary code with elevated privileges.CVE-2015-7336lenovosystem_updateEPSS score0.59%
MITRE is populating this ID because it was assigned prior to Lenovo becoming a CNA. A vulnerability was reported (fixed and publicly disclosed in 2015) in Lenovo System Update version 5.07.0008 and prior that could allow the signature check of an update to be bypassed.CVE-2015-6971lenovosystem_updateEPSS score0.47%
Lenovo System Update (formerly ThinkVantage System Update) before 5.07.0013 allows local users to submit commands to the System Update service (SUService.exe) and gain privileges by launching signed Lenovo executables.CVE-2020-8342lenovosystem_updateEPSS score0.22%
A race condition vulnerability was reported in Lenovo System Update prior to version 5.07.0106 that could allow escalation of privilege.CVE-2022-0354lenovosystem_updateEPSS score0.26%
A vulnerability was reported in Lenovo System Update that could allow a local user with interactive system access the ability to execute code with elevated privileges only during the installation of a System Update package released before 2022-02-25 that displays a command prompt window.CVE-2022-4568lenovolenovo_system_update+1EPSS score0.19%
A directory permissions management vulnerability in Lenovo System Update may allow elevation of privileges.CVE-2019-6163lenovosystem_updateEPSS score0.84%
A denial of service vulnerability was reported in Lenovo System Update before version 5.07.0084 that could allow service log files to be written to non-standard locations.CVE-2019-6175lenovosystem_updateEPSS score1.68%
A denial of service vulnerability was reported in Lenovo System Update versions prior to 5.07.0088 that could allow configuration files to be written to non-standard locations.CVE-2026-6387lenovosystem_updateEPSS score0.18%
A potential authentication bypass vulnerability was reported in Lenovo System Update that could allow a local authenticated user to execute arbitrary code with elevated privileges.CVE-2023-4632lenovolenovo_system_update+1EPSS score0.32%
An uncontrolled search path vulnerability was reported in Lenovo System Update that could allow an attacker with local access to execute code with elevated privileges.