CVE-2015-2219: lenovo system_update
Vulnerability summary
CVE-2015-2219 is a high (CVSS 7.2) vulnerability in lenovo system_update. EPSS estimates a 4.15% chance of exploitation in the next 30 days, higher than 90.7% of scored vulnerabilities. 2 public exploits are recorded.
Timeline
- 12-05-2015PublishedVulnerability first disclosed.
- 06-08-2024Last modifiedVulnerability information updated.
Description
Lenovo System Update (formerly ThinkVantage System Update) before 5.06.0034 uses predictable security tokens, which allows local users to gain privileges by sending a valid token with a command to the System Update service (SUService.exe) through an unspecified named pipe.
CVSS metrics
1 score · 1 source · 1 versionEPSS trend
Probability
4.15%
Chance of exploitation in the next 30 days
Percentile
91%
Versus all other CVEs
30-day change
0.00 pp
From 4.15% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
2 foundLenovo System Update - Local Privilege Escalation (Metasploit)
Maturity: weaponized
Lenovo System Update Privilege Escalation
exploit/windows/local/lenovo_systemupdate
Maturity: weaponized
Weaknesses
CWE · root causeAffected systems
Lenovo1 product
- system_update≤ 5.06.0027
1 vendor · 1 product