Lenovo Vantage SmartPerformanceAddin Improper Link Following Vulnerability Allowing Arbitrary File Deletion

A vulnerability has been identified in the SmartPerformanceAddin for Lenovo Vantage, where improper link following could enable an authenticated local user to delete arbitrary files with elevated privileges. This issue has been classified as a medium-severity denial-of-service vulnerability.

Impact

Exploitation of this vulnerability could lead to unauthorized deletion of files, potentially causing disruption or loss of data.

Remediation

Users are advised to update the Vantage SmartPerformanceAddin to version 1.1.0.1111 or later. This add-in is automatically updated by Lenovo Vantage. For manual update instructions, visit the Lenovo Drivers & Software support site for your product.