ZDI-24-1310: Lenovo Service Bridge Command Injection Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Lenovo Service Bridge. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.5. The following CVEs are assigned: CVE-2024-4696.
Affected Software
Event History
Frequently Asked Questions
What is the severity of ZDI-24-1310?
The vulnerability ZDI-24-1310 is considered to have a significant severity due to its potential for remote code execution.
How do I fix ZDI-24-1310?
To mitigate ZDI-24-1310, users should update Lenovo Service Bridge to the latest version provided by Lenovo.
What type of attack can leverage ZDI-24-1310?
ZDI-24-1310 can be exploited through remote code execution when users interact with malicious web pages or files.
Does ZDI-24-1310 require user interaction?
Yes, exploiting ZDI-24-1310 requires user interaction, such as visiting a malicious page or opening a malicious file.
Which software is impacted by ZDI-24-1310?
ZDI-24-1310 affects installations of Lenovo Service Bridge.