Dynamic Power Reduction Utility Vulnerability
Dynamic Power Reduction Utility Vulnerability
Dynamic Power Reduction Utility Vulnerability
Lenovo Security Advisory: LEN-25674
Potential Impact: Privilege escalation
Severity: Medium
Scope of Impact: Lenovo-specific
CVE Identifier: CVE-2019-6149
Summary Description:
An unquoted search path vulnerability was identified in Dynamic Power Reduction Utility, affecting ThinkPad X1 Carbon (Machine types: 20KH, 20KG) that could allow a malicious user with local access to execute code with administrative privileges.
Mitigation Strategy for Customers (what you should do to protect yourself):
Update to Dynamic Power Reduction Utility version 2.2.2.0 (or newer) for ThinkPad X1 Carbon (Machine types: 20KH, 20KG).
Acknowledgements:
Lenovo would like to thank Security Advisor Kenni Lund from Improsec for reporting this issue.
Revision History:
Revision | Date | Description |
---|---|---|
2 | 2020-04-07 | Clarified in Summary and Mitigation sections this only affects ThinkPad X1 Carbon (Machine types: 20KH, 20KG). |
1 | 2019-03-14 | Initial release |
For a complete list of all Lenovo Product Security Advisories, click here.
For the most up to date information, please remain current with updates and advisories from Lenovo regarding your equipment and software. The information provided in this advisory is provided on an “as is” basis without any warranty or guarantee of any kind. Lenovo reserves the right to change or update this advisory at any time.
Your feedback helps to improve the overall experience