System Update
Vendor:
First CVE: May 12, 2015 · Active for 11 years
15
Total CVEs
More Total CVEs than 92% of tracked products
2.1
Avg CVEs / Year
Higher CVE frequency than 73% of tracked products
7.6
Avg CVSS
Higher Avg CVSS than 60% of tracked products
0.0%
KEV Rate
Bottom 1%
Trends Over Time
The number and severity of CVEs published that impact System Update over time
Volume of CVEsAvg CVSS Base Score
First CVE
May 12, 2015
11 years ago
Most Recent CVE
Nov 8, 2023
990 days ago
CVE Severity & Scoring
System Update15 CVEs
93%
All CVEs352,708 CVEs
45%
40%
11%
MediumHigh
Attack Vector
Local9 (60.0%)
Network3 (20.0%)
Unknown3 (20.0%)
Physical0 (0.0%)
Adjacent Network0 (0.0%)
Attack Complexity
Low10 (66.7%)
High2 (13.3%)
Unknown3 (20.0%)
User Interaction
None12 (80.0%)
Unknown3 (20.0%)
Required0 (0.0%)
Privileges Required
Low9 (60.0%)
High0 (0.0%)
None3 (20.0%)
Unknown3 (20.0%)
Top CVEs
Signals from CVEs in this product scope (15 CVEs).
15 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2015-2219HIGH Lenovo System Update (formerly ThinkVantage System Update) before 5.06.0034 uses predictable security tokens, which allows local users to gain privileges by sending a valid token w | May 12, 2015 | 7.2 | 36 | NO | YES |
CVE-2023-4632HIGH An uncontrolled search path vulnerability was reported in Lenovo System Update that could allow an attacker with local access to execute code with elevated privileges. | Nov 8, 2023 | 7.8 | 25 | NO | NO |
CVE-2015-7334HIGH MITRE is populating this ID because it was assigned prior to Lenovo becoming a CNA. A local privilege escalation vulnerability was reported (fixed and publicly disclosed in 2015) i | Mar 27, 2020 | 7.8 | 25 | NO | NO |
CVE-2019-6163HIGH A denial of service vulnerability was reported in Lenovo System Update before version 5.07.0084 that could allow service log files to be written to non-standard locations. | Jun 26, 2019 | 7.5 | 25 | NO | NO |
CVE-2022-4568HIGH A directory permissions management vulnerability in Lenovo System Update may allow elevation of privileges. | May 1, 2023 | 7.8 | 24 | NO | NO |
CVE-2020-8342HIGH A race condition vulnerability was reported in Lenovo System Update prior to version 5.07.0106 that could allow escalation of privilege. | Sep 15, 2020 | 7.0 | 23 | NO | NO |
CVE-2015-2233HIGH Lenovo System Update (formerly ThinkVantage System Update) before 5.06.0034 does not properly validate CA chains during signature validation, which allows man-in-the-middle attacke | May 12, 2015 | 8.3 | 21 | NO | NO |
CVE-2015-7333HIGH MITRE is populating this ID because it was assigned prior to Lenovo becoming a CNA. A local privilege escalation vulnerability was reported (fixed and publicly disclosed in 2015) i | Mar 27, 2020 | 7.8 | 20 | NO | NO |
CVE-2018-9063HIGH MapDrv (C:\Program Files\Lenovo\System Update\mapdrv.exe) In Lenovo System Update versions earlier than 5.07.0072 contains a local vulnerability where an attacker entering very lar | May 4, 2018 | 7.8 | 20 | NO | NO |
CVE-2015-6971HIGH Lenovo System Update (formerly ThinkVantage System Update) before 5.07.0013 allows local users to submit commands to the System Update service (SUService.exe) and gain privileges b | Oct 3, 2017 | 7.8 | 20 | NO | NO |
Exploit Exposure
Signals from CVEs in this product scope (15 CVEs).
CISA KEV
0 CVEs
0.0% of CVEs· Bottom 1%
Metasploit
1 CVE
6.7% of CVEs· 97th percentile
Nuclei
0 CVEs
0.0% of CVEs· Bottom 1%
ExploitDB
1 CVE
6.7% of CVEs· 88th percentile
Social Chatter
Signals from CVEs in this product scope (15 CVEs).
Media Mentions
Signals from CVEs in this product scope (15 CVEs).
Top CNAs Publishing CVEs For System Update
Top CWEs
Versions
No cataloged versions.