Lenovo Vantage and Baiying Input Validation Vulnerability Allowing Registry Key Deletion

An input validation vulnerability exists in the DeviceSettingsSystemAddin component of Lenovo Vantage and Lenovo Baiying. This vulnerability could enable a local authenticated user to delete arbitrary registry keys with elevated privileges. The issue arises from insufficient input validation, allowing unauthorized modifications to the Windows registry.

Impact

Exploitation of this vulnerability could lead to unauthorized deletion of registry keys, potentially disrupting system configuration or application behavior.

Remediation

Users should update the Vantage DeviceSettingsSystemAddin to version 1.0.8.15 or later. This addin is automatically updated by Lenovo Vantage. For Lenovo Baiying, similar update mechanisms may apply, but users should consult Lenovo's support resources for specific guidance.