CVE-2023-6044: 
Lenovo Vantage vulnerability analysis and mitigation

A privilege escalation vulnerability (CVE-2023-6044) was discovered in Lenovo Vantage that could allow a local attacker with physical access to impersonate Lenovo Vantage Service and execute arbitrary code with elevated privileges. The vulnerability affects Lenovo Vantage versions up to (excluding) 4.0.49.0 (NVD, CVE).

The vulnerability has been assigned a CVSS v3.1 base score of 6.8 (Medium) by NIST with the vector string CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Lenovo Group Ltd. assessed it with a slightly lower score of 6.3 (Medium) with the vector CVSS:3.1/AV:P/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. The vulnerability is classified as CWE-290 (Authentication Bypass by Spoofing) (NVD).

If exploited, this vulnerability allows an attacker with physical access to execute arbitrary code with elevated privileges by impersonating the Lenovo Vantage Service. This could lead to complete system compromise with high impacts on confidentiality, integrity, and availability (NVD).

Users should update Lenovo Vantage to version 4.0.49.0 or later to address this vulnerability (NVD).