CVE-2024-12673CWE-250

An improper privilege vulnerability was reported in a BIOS customization feature of Lenovo Vantage on SMB notebook devices which could allow a local attacker…

High · published February 12, 2025

CVSS v4.0
8.5
EPSS
0%
Percentile
7.3
In the wild
Unconfirmed
What it is

An improper privilege vulnerability was reported in a BIOS customization feature of Lenovo Vantage on SMB notebook devices which could allow a local attacker to elevate privileges on the system.

This vulnerability only affects Vantage installed on these devices:

* Lenovo V Series (Gen 5)

* ThinkBook 14 (Gen 6, 7)

* ThinkBook 16 (Gen 6, 7)

* ThinkPad E Series (Gen 1)

The record
Technical detail
CVSS v4.0
8.5 · HIGH
Vector
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00181 · 7.3th percentile
Weakness
CWE-250 · Execution with Unnecessary Privileges
Published
2025-02-12T20:31Z
EPSS history
Timeline
  • 12 FEB 20:31Z
    An improper privilege vulnerability was reported in a BIOS customization feature of Lenovo Vantage on SMB notebook devices which could allow a local attacker…
    cvelistv5