Executive brief
A vulnerability in Lenovo's enterprise management software for accessories and displays could allow a person with basic access to a Windows computer to gain full control over the system. By exploiting this flaw, an attacker who is already logged in as a standard user could run malicious programs with high-level administrative privileges. This could lead to the theft of sensitive data, installation of persistent malware, or complete disruption of the affected workstation.
Technical details
A local privilege escalation vulnerability exists in Lenovo Accessories and Display Manager for Enterprise for Windows due to missing authentication for a critical function (CWE-306). An authenticated attacker with low-level local access can exploit this flaw to execute arbitrary code with SYSTEM or administrative privileges. The attack vector is local, requiring no user interaction and having low complexity. Lenovo has addressed this issue in security advisory LEN-213623, and users are advised to update to the latest version of the software.
Affected products
- Lenovo Accessories and Display Manager for Enterprise Windows versions prior to latest patch
Timeline
- 2026-06-10: disclosed: Initial publication of the vulnerability advisory.
- 2026-06-10: advisory: Lenovo published security advisory LEN-213623.