description: A local privilege escalation vulnerability in the ThinkPad Hybrid USB-C with USB-A Dock Firmware Update Tool could allow an attacker with local access to execute code with elevated privileges during the package upgrade or installation.
problem types: CWE-276 Incorrect Default Permissions
affected:
{
defaultStatus: unaffected
product: ThinkPad Hybrid USB-C with USB-A Dock Firmware Update Tool
vendor: Lenovo
versions:
status: affected, version: versions prior to v1.0.35_v2
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
]
format: CVSS
scenarios: GENERAL
solutions: Customers should update their ThinkPad Dock Firmware Update Tool to version v1.0.35_v2 or later