description: A DLL search path vulnerability was reported in the Lenovo HardwareScan Plugin for the Lenovo Vantage hardware scan feature prior to version 1.0.46.11 that could allow escalation of privilege.
problem types: CWE-427 Uncontrolled Search Path Element
affected:
{
product: Vantage HardwareScan Plugin
vendor: Lenovo
versions:
lessThan: 1.0.46.11, status: affected, version: unspecified, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.3
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
version: 3.1
]
solutions: Update the Lenovo HardwareScan Plugin to version 1.0.46.11.
The Lenovo HardwareScan Plugin is automatically updated by the Lenovo System Interface Foundation Service. To immediately start the update process, reboot the computer or restart the "System Interface Foundation Service" service.
To verify the Lenovo HardwareScan Plugin version:
Open File Explorer and navigate to C:\ProgramData\Lenovo\ImController\Plugins\LenovoHardwareScanPlugin\x64
Right click on LenovoHardwareScanPlugin.dll and select Properties.
Click on the Details tab.
Read the File version.