#VU27003 Insecure DLL loading in Lenovo System Interface Foundation - CVE-2020-8324

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU27003

#VU27003 Insecure DLL loading in Lenovo System Interface Foundation - CVE-2020-8324

Published: April 17, 2020 / Updated: April 27, 2020


Vulnerability identifier: #VU27003
Vulnerability risk: Low
CVSSv4.0: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/U:Clear
CVE-ID: CVE-2020-8324
CWE-ID: CWE-427
Exploitation vector: Local access
Exploit availability: Public exploit is available
Vulnerable software:
Lenovo System Interface Foundation
Software vendor:
Lenovo

Description

The vulnerability allows a local user to compromise vulnerable system.

The vulnerability exists due to the application loads DLL libraries in an insecure manner in LenovoAppScenarioPluginSystem for Lenovo System Interface Foundation component for Lenovo Vantage. A local user can place a specially crafted .dll file on a remote SMB fileshare, trick the victim into opening a file, associated with the vulnerable application, and execute arbitrary code on victim's system.


Remediation

Install updates from vendor's website.

External links