CVE-2022-3699
Published: 25 October 2023
Summary
CVE-2022-3699 is a high-severity Out-of-bounds Write (CWE-787) vulnerability in Lenovo Diagnostics. Its CVSS base score is 7.8 (High).
Operationally, ranked in the top 0.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
A privilege escalation vulnerability tracked as CVE-2022-3699 affects the Lenovo HardwareScanPlugin prior to version 1.3.1.2 and Lenovo Diagnostics prior to version 4.45. The flaw, assigned CWE-787, permits a local attacker to execute arbitrary code with elevated privileges on affected systems, as reflected in its CVSS 3.1 score of 7.8.
A local user with standard privileges can exploit the issue without user interaction or special preconditions beyond local access. Successful exploitation grants the attacker full control over confidentiality, integrity, and availability, enabling code execution at a higher privilege level than the initial account.
Lenovo security advisories LEN-102365 and LEN-94532 recommend updating the HardwareScanPlugin to version 1.3.1.2 or later and Lenovo Diagnostics to version 4.45 or later to address the vulnerability. The EPSS score has remained elevated near 0.85 with only minor fluctuation between its current value of 0.8450 and peak of 0.8578.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-43057
Vulnerability details
A privilege escalation vulnerability was reported in the Lenovo HardwareScanPlugin prior to version 1.3.1.2 and Lenovo Diagnostics prior to version 4.45 that could allow a local user to execute code with elevated privileges.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Out-of-bounds writes that corrupt control flow or inject shellcode are rendered non-executable by the same memory protections.