CVE-2015-2219
Lenovo System Update (formerly ThinkVantage System Update) before 5.06.0034 uses predictable security tokens, which allows local users to gain privileges by sending a valid token with a command to the System Update service (SUService.exe) through an…
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (4.15%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Lenovo System Update (formerly ThinkVantage System Update) before 5.06.0034 uses predictable security tokens, which allows local users to gain privileges by sending a valid token with a command to the System Update service (SUService.exe) through an unspecified named pipe.
- CVSS 2.0
- 7.2 HIGHAV:L/AC:L/Au:N/C:C/I:C/A:C
- EPSS
- 4.15% probability · 90th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-264
- Affected
- lenovo/system update
- Source
- cve@mitre.org
References
- http://securitytracker.com/id/1032268
- http://support.lenovo.com/us/en/product_security/lsu_privilegeVendor Advisory
- http://www.ioactive.com/pdfs/Lenovo_System_Update_Multiple_Privilege_Escalations.pdf
- http://www.securityfocus.com/bid/74649
- http://securitytracker.com/id/1032268
- http://support.lenovo.com/us/en/product_security/lsu_privilegeVendor Advisory
- http://www.ioactive.com/pdfs/Lenovo_System_Update_Multiple_Privilege_Escalations.pdf
- http://www.securityfocus.com/bid/74649
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.