CVE-2019-6175: vulnerability in Lenovo System Update
System Update Vulnerability
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
Lenovo System Update versions before 5.07.0088 have a flaw that allows denial of service attacks by writing configuration files to unexpected locations on the system. This can disrupt normal system operation and cause the software to malfunction.
A path traversal vulnerability in Lenovo System Update <5.07.0088 permits unauthenticated attackers to write configuration files to arbitrary locations, potentially overwriting critical system files or causing application failures. The vulnerability requires local or network-based write access to trigger the malicious configuration file placement.
In the same product, most dangerous first.