CVE-2025-2501

An untrusted search path vulnerability was reported in Lenovo PC Manager that could allow a local attacker to elevate privileges.

CVSS v3 7.8 HIGH

7.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://iknow.lenovo.com.cn/detail/428586	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:lenovo:pcmanager:*:*:*:*:*:*:*:*

History

02 Feb 2026, 15:29

Type	Values Removed	Values Added
Summary		(es) Se informó de una vulnerabilidad de ruta de búsqueda no confiable en Lenovo PC Manager que podría permitir que un atacante local eleve privilegios.
First Time		Lenovo Lenovo pcmanager
References	~~() https://iknow.lenovo.com.cn/detail/428586 -~~	() https://iknow.lenovo.com.cn/detail/428586 - Vendor Advisory
CPE		cpe:2.3:a:lenovo:pcmanager::::::::

30 May 2025, 20:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-05-30 20:15

Updated : 2026-02-02 15:29

NVD link : CVE-2025-2501

Mitre link : CVE-2025-2501

CVE.ORG link : CVE-2025-2501

JSON object : View

Products Affected

lenovo

pcmanager

CWE

CWE-426

Untrusted Search Path

{"id": "CVE-2025-2501", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "psirt@lenovo.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}], "cvssMetricV40": [{"type": "Secondary", "source": "psirt@lenovo.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.5, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "published": "2025-05-30T20:15:42.187", "references": [{"url": "https://iknow.lenovo.com.cn/detail/428586", "tags": ["Vendor Advisory"], "source": "psirt@lenovo.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "psirt@lenovo.com", "description": [{"lang": "en", "value": "CWE-426"}]}], "descriptions": [{"lang": "en", "value": "An untrusted search path vulnerability was reported in Lenovo PC Manager that could allow a local attacker to elevate privileges."}, {"lang": "es", "value": "Se inform\u00f3 de una vulnerabilidad de ruta de b\u00fasqueda no confiable en Lenovo PC Manager que podr\u00eda permitir que un atacante local eleve privilegios."}], "lastModified": "2026-02-02T15:29:29.790", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:lenovo:pcmanager:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9E61A472-5D52-4BE7-A375-AA87C579DF6B", "versionEndExcluding": "5.1.110.5082"}], "operator": "OR"}]}], "sourceIdentifier": "psirt@lenovo.com"}