CVE-2026-1717

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-1717", "assignerOrgId": "da227ddf-6e25-4b41-b023-0f976dcaca4b", "state": "PUBLISHED", "assignerShortName": "lenovo", "dateReserved": "2026-01-30T19:00:49.191Z", "datePublished": "2026-03-11T20:22:50.139Z", "dateUpdated": "2026-03-12T16:18:25.059Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "packageName": "LenovoProductivitySystemAddin", "product": "Vantage", "vendor": "Lenovo", "versions": [{"lessThan": "1.0.0.138", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "packageName": "LenovoProductivitySystemAddin", "product": "Baiying", "vendor": "Lenovo", "versions": [{"lessThan": "1.0.0.138", "status": "affected", "version": "0", "versionType": "custom"}]}], "cpeApplicability": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:lenovo:vantage:*:*:*:*:*:*:*:*", "versionEndExcluding": "1.0.0.138", "versionStartIncluding": "0", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:a:lenovo:baiying:*:*:*:*:*:*:*:*", "versionEndExcluding": "1.0.0.138", "versionStartIncluding": "0", "vulnerable": true}], "negate": false, "operator": "OR"}], "operator": "OR"}], "credits": [{"lang": "en", "type": "finder", "value": "Lenovo thanks Manuel Kiesel (cyllective AG) for reporting this issue."}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "An input validation vulnerability was reported in the LenovoProductivitySystemAddin used in Lenovo Vantage and Lenovo Baiying that could allow a local authenticated user to terminate arbitrary processes with elevated privileges."}], "value": "An input validation vulnerability was reported in the LenovoProductivitySystemAddin used in Lenovo Vantage and Lenovo Baiying that could allow a local authenticated user to terminate arbitrary processes with elevated privileges."}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "LOCAL", "baseScore": 6.8, "baseSeverity": "MEDIUM", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}, {"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-88", "description": "CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "da227ddf-6e25-4b41-b023-0f976dcaca4b", "shortName": "lenovo", "dateUpdated": "2026-03-11T20:22:50.139Z"}, "references": [{"url": "https://support.lenovo.com/us/en/product_security/LEN-213044"}, {"url": "https://iknow.lenovo.com.cn/detail/438815"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<div><div><div><p>Update Vantage LenovoProductivitySystemAddin to version 1.0.0.138 or later.</p><p>LenovoProductivitySystemAddin is automatically updated by Lenovo Vantage and Baiying.</p></div></div></div>"}], "value": "Update Vantage LenovoProductivitySystemAddin to version 1.0.0.138 or later.\n\nLenovoProductivitySystemAddin is automatically updated by Lenovo Vantage and Baiying."}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.0-beta"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-12T15:35:46.758689Z", "id": "CVE-2026-1717", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-12T16:18:25.059Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-1717", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-12T15:35:46.758689Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-12T15:35:47.594Z"}}], "cna": {"source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Lenovo thanks Manuel Kiesel (cyllective AG) for reporting this issue."}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.8, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Lenovo", "product": "Vantage", "versions": [{"status": "affected", "version": "0", "lessThan": "1.0.0.138", "versionType": "custom"}], "packageName": "LenovoProductivitySystemAddin", "defaultStatus": "unaffected"}, {"vendor": "Lenovo", "product": "Baiying", "versions": [{"status": "affected", "version": "0", "lessThan": "1.0.0.138", "versionType": "custom"}], "packageName": "LenovoProductivitySystemAddin", "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Update Vantage LenovoProductivitySystemAddin to version 1.0.0.138 or later.\n\nLenovoProductivitySystemAddin is automatically updated by Lenovo Vantage and Baiying.", "supportingMedia": [{"type": "text/html", "value": "<div><div><div><p>Update Vantage LenovoProductivitySystemAddin to version 1.0.0.138 or later.</p><p>LenovoProductivitySystemAddin is automatically updated by Lenovo Vantage and Baiying.</p></div></div></div>", "base64": false}]}], "references": [{"url": "https://support.lenovo.com/us/en/product_security/LEN-213044"}, {"url": "https://iknow.lenovo.com.cn/detail/438815"}], "x_generator": {"engine": "Vulnogram 1.0.0-beta"}, "descriptions": [{"lang": "en", "value": "An input validation vulnerability was reported in the LenovoProductivitySystemAddin used in Lenovo Vantage and Lenovo Baiying that could allow a local authenticated user to terminate arbitrary processes with elevated privileges.", "supportingMedia": [{"type": "text/html", "value": "An input validation vulnerability was reported in the LenovoProductivitySystemAddin used in Lenovo Vantage and Lenovo Baiying that could allow a local authenticated user to terminate arbitrary processes with elevated privileges.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-88", "description": "CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:lenovo:vantage:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "1.0.0.138", "versionStartIncluding": "0"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:lenovo:baiying:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "1.0.0.138", "versionStartIncluding": "0"}], "operator": "OR"}], "operator": "OR"}], "providerMetadata": {"orgId": "da227ddf-6e25-4b41-b023-0f976dcaca4b", "shortName": "lenovo", "dateUpdated": "2026-03-11T20:22:50.139Z"}}}, "cveMetadata": {"cveId": "CVE-2026-1717", "state": "PUBLISHED", "dateUpdated": "2026-03-12T16:18:25.059Z", "dateReserved": "2026-01-30T19:00:49.191Z", "assignerOrgId": "da227ddf-6e25-4b41-b023-0f976dcaca4b", "datePublished": "2026-03-11T20:22:50.139Z", "assignerShortName": "lenovo"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "packageName": "LenovoProductivitySystemAddin", "product": "Vantage", "vendor": "Lenovo", "versions": [{"lessThan": "1.0.0.138", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "packageName": "LenovoProductivitySystemAddin", "product": "Baiying", "vendor": "Lenovo", "versions": [{"lessThan": "1.0.0.138", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "psirt@lenovo.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:lenovo:vantage:*:*:*:*:*:*:*:*", "matchCriteriaId": "AD76E56B-E824-402D-B6F3-3B7E96FE73A4", "versionEndExcluding": "1.0.0.138", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "An input validation vulnerability was reported in the LenovoProductivitySystemAddin used in Lenovo Vantage and Lenovo Baiying that could allow a local authenticated user to terminate arbitrary processes with elevated privileges."}, {"lang": "es", "value": "Una vulnerabilidad de validaci\u00f3n de entrada fue reportada en el LenovoProductivitySystemAddin utilizado en Lenovo Vantage y Lenovo Baiying que podr\u00eda permitir a un usuario local autenticado terminar procesos arbitrarios con privilegios elevados."}], "id": "CVE-2026-1717", "lastModified": "2026-06-17T10:16:23.297", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "psirt@lenovo.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.8, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "psirt@lenovo.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-1717", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-12T15:35:46.758689Z", "version": "2.0.3"}}]}, "published": "2026-03-11T21:16:15.213", "references": [{"source": "psirt@lenovo.com", "tags": ["Vendor Advisory"], "url": "https://iknow.lenovo.com.cn/detail/438815"}, {"source": "psirt@lenovo.com", "tags": ["Vendor Advisory"], "url": "https://support.lenovo.com/us/en/product_security/LEN-213044"}], "sourceIdentifier": "psirt@lenovo.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-88"}], "source": "psirt@lenovo.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,1.0.0.138)"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Baiying", "source": "cna", "vendor": "Lenovo"}, "product": "baiying", "vendor": "lenovo"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,1.0.0.138)"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Vantage", "source": "cna", "vendor": "Lenovo"}, "product": "vantage", "vendor": "lenovo"}], "analysis": {"en": {"generated_at": "2026-03-17T14:53:23.000511+00:00", "value": {"mitigation_remediation": ["Update LenovoProductivitySystemAddin to version 1.0.0.138 or later via Lenovo Vantage or Baiying.", "Verify that automatic updates are enabled for Lenovo Vantage and Baiying to receive future patches."], "summary": {"action": "Patch", "impact": "Privilege Escalation/Denial of Service"}, "threat_synthesis": {"affected_systems": "The affected products are Lenovo Vantage and Lenovo Baiying, specifically the LenovoProductivitySystemAddin. Versions prior to 1.0.0.138 of the addin are impacted. Users running any earlier release through Lenovo Vantage or Baiying are vulnerable.", "description_and_impact": "This vulnerability is an input validation flaw in the LenovoProductivitySystemAddin component used by Lenovo Vantage and Lenovo Baiying. A local authenticated user can invoke actions that terminate arbitrary processes running with elevated privileges. Key impact includes the ability to disrupt critical system or security processes, potentially leading to service interruption or denial of service, and could be leveraged as a foothold for privilege escalation. The weakness is classified as CWE\u201188, indicating insufficient validation that trusts user input.", "risk_and_exploitability": "The CVSS v3.1 score is 6.8, indicating a moderate severity. EPSS is below 1%, suggesting a low likelihood of widespread exploitation, and the vulnerability is not listed in the CISA KEV catalog. Attack requires local authentication; the attacker must be able to access the Vantage or Baiying addin to trigger the process termination. No remote execution vector is disclosed."}}}}, "created": "2026-03-12T09:56:03.766370+00:00", "title": "Local Authenticated Process Termination via Input Validation in LenovoProductivitySystemAddin", "updated": "2026-03-20T15:37:10.796697+00:00", "vendors": ["lenovo", "lenovo$PRODUCT$baiying", "lenovo$PRODUCT$vantage"]}