CVE-2015-6971: Command Injection
Published Oct 2, 2017
·Updated
Lenovo System Update (formerly ThinkVantage System Update) before 5.07.0013 allows local users to submit commands to the System Update service (SUService.exe) and gain privileges by launching signed Lenovo executables.
Affected Software
1 affected component
Lenovo System Update<=5.06.0034
Event History
Oct 2, 2017
CVE Published
via MITRE·06:00 PM
Data Sourced
via MITRE·06:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2015-6971?
CVE-2015-6971 is classified as a privilege escalation vulnerability.
2
How do I fix CVE-2015-6971?
To fix CVE-2015-6971, update the Lenovo System Update to version 5.07.0013 or later.
3
What is affected by CVE-2015-6971?
CVE-2015-6971 affects Lenovo System Update versions prior to 5.07.0013.
4
Who is vulnerable to CVE-2015-6971?
Local users with access to the affected Lenovo System Update are vulnerable to CVE-2015-6971.
5
What can an attacker achieve with CVE-2015-6971?
An attacker exploiting CVE-2015-6971 can submit unauthorized commands and gain elevated privileges.