CVE-2025-8485CWE-276

CVE-2025-8485

High · published November 13, 2025

CVSS v3.1
7.3
EPSS
0%
Percentile
2.4
In the wild
Unconfirmed
What it is

⚡ A misstep in app permissions could turn any local user into an admin—think of it like giving a chef the keys to the entire restaurant, not just the kitchen! 🔑 This vulnerability is like having a restaurant where the chef can wander into the vault and start cooking with the finest ingredients without any checks—anyone with a local account can gain elevated privileges during app installation! An attacker could leverage this flaw to execute malicious code with elevated privileges, potentially compromising the entire system. Imagine someone gaining access to sensitive files, altering software settings, or even installing harmful applications, all while masquerading as a legitimate user! It's a recipe for disaster!

Put simply

This vulnerability is like having a restaurant where the chef can wander into the vault and start cooking with the finest ingredients without any checks—anyone with a local account can gain elevated privileges during app installation! CVE-2025-8485 is an improper permissions vulnerability in the Lenovo App Store that permits authenticated local users to execute code with higher privileges during the installation of applications, bypassing intended security restrictions.

What to do

An attacker could leverage this flaw to execute malicious code with elevated privileges, potentially compromising the entire system. Imagine someone gaining access to sensitive files, altering software settings, or even installing harmful applications, all while masquerading as a legitimate user! It's a recipe for disaster! To mitigate this risk, ensure that the Lenovo App Store is updated to the latest version where this vulnerability is patched. Review user permissions and limit access where possible to reduce potential exploit scenarios. Encourage users to be cautious during installations and only install from trusted sources. 🔒 You've got this! Stay vigilant, follow these steps, and keep your systems secure! 🛡️

The record
Technical detail
CVSS v3.1
7.3 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00131 · 2.4th percentile
Weakness
CWE-276 · Incorrect Default Permissions
Published
2025-11-13T01:15Z
Affected products (1)
ProductVersionsFixed in
lenovo/app_store< 9.0.2530.10279.0.2530.1027
References (1)
EPSS history
Timeline
  • 12 NOV 19:18Z
    An improper permissions vulnerability was reported in Lenovo App Store that could allow a local authenticated user to execute code with elevated privileges…
    cvelistv5