Insecure DLL loading in Lenovo System Interface Foundation - CVE-2020-8324
Published: April 17, 2020 / Updated: April 27, 2020
Vulnerability identifier: #VU27003
CSH Severity: Low
CVSS v4.0: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/U:Clear
CVE-ID: CVE-2020-8324
CWE-ID: CWE-427
Exploitation vector: Local access
Exploit availability:
Public exploit is available
Vendor: Lenovo
Affected software:
Lenovo System Interface Foundation
Lenovo System Interface Foundation
Detailed vulnerability description
The vulnerability allows a local user to compromise vulnerable system.
The vulnerability exists due to the application loads DLL libraries in an insecure manner in LenovoAppScenarioPluginSystem for Lenovo System Interface Foundation component for Lenovo Vantage. A local user can place a specially crafted .dll file on a remote SMB fileshare, trick the victim into opening a file, associated with the vulnerable application, and execute arbitrary code on victim's system.
How to mitigate CVE-2020-8324
Install updates from vendor's website.