Lenovo Vantage and Baiying Input Validation Vulnerability in DeviceSettingsSystemAddin Allowing Registry Modification

An input validation vulnerability exists in the DeviceSettingsSystemAddin component of Lenovo Vantage and Lenovo Baiying. This vulnerability could enable a local authenticated user to modify arbitrary registry keys with elevated privileges. The issue arises from insufficient input validation, allowing unauthorized changes to the registry.

Impact

Exploitation of this vulnerability could lead to unauthorized modification of the Windows registry, potentially allowing for further privilege escalation or manipulation of system settings.

Remediation

Users are advised to update the Vantage DeviceSettingsSystemAddin to version 1.0.8.15 or later. This addin is automatically updated by Lenovo Vantage. For Lenovo products sold in China, refer to the Lenovo China support site for update instructions.