Privilege Escalation in Lenovo HardwareScanPlugin and Diagnostics Software
CVE-2022-3699

7.8HIGH

Key Information:

Vendor
Lenovo
Status
Hardwarescanplugin
Diagnostics
Vendor
CVE Published:
25 October 2023

Badges

👾 Exploit Exists🟡 Public PoC🟣 EPSS 84%

Summary

A privilege escalation vulnerability was identified in Lenovo's HardwareScanPlugin and Diagnostics software. This vulnerability affects versions of the HardwareScanPlugin prior to 1.3.1.2 and versions of Lenovo Diagnostics prior to 4.45. An attacker with local access may exploit this vulnerability to execute arbitrary code with elevated privileges, potentially compromising the system's integrity and security. Users are advised to update to the latest versions to mitigate this risk.

Affected Version(s)

Diagnostics < 4.45

HardwareScanPlugin < 1.3.1.2

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2022-3699
Created by alfarom256

lenovo_exec
Created by estimated1337

CVE-2022-3699
Created by Eap2468

References

https://support.lenovo.com/us/en/product_security/LEN-94532
https://support.lenovo.com/us/en/product_security/LEN-102365

EPSS Score

84% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Lenovo thanks Mike Alfaro at Nephosec for reporting this issue.
.