Improper Authorization Enabling Local Privileged Code Execution in Lenovo Baiying PC Client

A potential improper authorization vulnerability was reported in Lenovo Baiying PC Client, distributed exclusively in the Chinese market, that could allow a local authenticated user to execute arbitrary code with elevated privileges.

A DLL hijack vulnerability was reported in Lenovo Baiying that could allow a local attacker to execute code with elevated privileges.

An improper permissions vulnerability was reported in Lenovo Baiying Client that could allow a local authenticated user to execute code with elevated privileges.

Input Validation Vulnerability Allowing Local Privilege Escalation in Lenovo DeviceSettingsSystemAddin

An input validation vulnerability was reported in the DeviceSettingsSystemAddin used in Lenovo Vantage and Lenovo Baiying that could allow a local authenticated user to modify arbitrary registry keys with elevated privileges.

Local Privilege Escalation via Input Validation in Lenovo Vantage & Baiying DeviceSettingsSystemAddin

An input validation vulnerability was reported in the DeviceSettingsSystemAddin used in Lenovo Vantage and Lenovo Baiying that could allow a local authenticated user to delete arbitrary registry keys with elevated privileges.

Local Authenticated Process Termination via Input Validation in LenovoProductivitySystemAddin

An input validation vulnerability was reported in the LenovoProductivitySystemAddin used in Lenovo Vantage and Lenovo Baiying that could allow a local authenticated user to terminate arbitrary processes with elevated privileges.

A certificate validation vulnerability exists in the Baiying Android application which could lead to information disclosure.