ID:12004 - Exploit for Improper access control in Lenovo products - CVE-2025-8061

Vulnerability identifier: #VU116098

Vulnerability risk: Low

CVE-ID: CVE-2025-8061

CWE-ID: CWE-284

Exploitation vector: Local access

Vulnerable software:
IdeaPad Pro 5 14AKP10
IdeaPad Pro 5 14ASP10
IdeaPad Pro 5 14IAH10
IdeaPad Pro 5 16AKP10
IdeaPad Pro 5 16ASP10
IdeaPad Pro 5 16IAH10
Legion Pro 7 16IAX10H
ThinkBook 13x G4 IMH
ThinkBook 14 2-in-1 G5 IAU
ThinkBook 14 G6+ IMH
ThinkBook 14 G8 IAL
ThinkBook 14 G8 IRL
ThinkBook 16 G7+ ASP
ThinkBook 16 G8 IAL
ThinkBook 16 G8 IRL
ThinkBook 16p G5 IRX
ThinkBook 16p G6 ADR
ThinkBook 16p G6 IAX
Yoga 9 2-in-1 14ILL10
Yoga 9 2-in-1 14IMH9
Yoga Book 9 13IMU9
Yoga Book 9 14IAH10
Yoga Pro 7 14AKP10
Yoga Pro 7 14ASP10
Yoga Pro 7 14IAH10
Yoga Pro 9 16IAH10
Yoga Pro 9 16IMH9
Yoga Slim 7 15ILL9
Yoga Slim 9 14ILL10
Lenovo Dispatcher 3.1 Driver - IdeaPad Pro 5 14AKP10, IdeaPad Pro 5 14ASP10
Lenovo Dispatcher 3.1 Driver for Windows 11 (64-bit) - IdeaPad Pro 5 14IAH10
Lenovo Dispatcher 3.1 Driver - IdeaPad Pro 5 16AKP10, IdeaPad Pro 5 16ASP10
Lenovo Dispatcher 3.1 Driver for Windows 11 (64-bit) - IdeaPad Pro 5 16IAH10
Lenovo Dispatcher 3.1 Driver for Windows 11 (64-bit) - Legion Pro 7 16IAX10H
Lenovo Dispatcher 3.0 Driver for Windows 11 (64-bit) - ThinkBook 13x G4 IMH
Lenovo Dispatcher 3.1 Driver for Windows 11 (64-bit) - ThinkBook 14 2-in-1 G5 IAU
Lenovo Dispatcher 3.0 Driver for Windows 10 (64-bit) - ThinkBook 14 G6+ IMH
Lenovo Dispatcher 3.0 Driver for Windows 11 (64-bit) - ThinkBook 14 G6+ IMH
Lenovo Dispatcher 3.1 Driver for Windows 11 (64-bit) - ThinkBook 14 G8 IAL, ThinkBook 16 G8 IAL
Lenovo Dispatcher 3.1 Driver for Windows 10 (64-bit) - ThinkBook 14 G8 IRL, ThinkBook 16 G8 IRL
Lenovo Dispatcher 3.1 Driver for Windows 11 (64-bit) - ThinkBook 14 G8 IRL, ThinkBook 16 G8 IRL
Lenovo Dispatcher 3.0 Driver for Windows 11 (64-bit) - ThinkBook 16 G7+ ASP
Lenovo Dispatcher 3.0 Driver for Windows 11 (64-bit) - ThinkBook 16p G5 IRX
Lenovo Dispatcher 3.1 Driver for Windows 11 (64-bit) - ThinkBook 16p G6 ADR
Lenovo Dispatcher 3.1 Driver for Windows 11 (64-bit) - ThinkBook 16p G6 IAX
Lenovo Dispatcher 3.1 Driver for Windows 11 (64-bit) - Yoga 9 2-in-1 14ILL10
Lenovo Dispatcher 3.0 Driver for Windows 11 (64-bit) - Yoga 9 2-in-1 14IMH9
Lenovo Dispatcher 3.0 Driver for Windows 11 (64-bit) - Yoga Book 9 13IMU9
Lenovo Dispatcher 3.1 Driver for Windows 11 (64-bit) - Yoga Book 9 14IAH10
Lenovo Dispatcher 3.1 Driver for Windows 11 (64-bit) - Yoga Pro 7 14AKP10, Yoga Pro 7 14ASP10
Lenovo Dispatcher 3.1 Driver for Windows 11 (64-bit) - Yoga Pro 7 14IAH10
Lenovo Dispatcher 3.1 Driver for Windows 11 (64-bit) - Yoga Pro 9 16IAH10
Lenovo Dispatcher 3.0 Driver for Windows 11 (64-bit) - Yoga Pro 9 16IMH9
Lenovo Dispatcher 3.1 for Windows 11 (64-bit) - Yoga Slim 7 15ILL9
Lenovo Dispatcher 3.1 Driver for Windows 11 (64-bit) - Yoga Slim 9 14ILL10

https://github.com/symeonp/Lenovo-CVE-2025-8061

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to improper access restrictions. A local user can execute arbitrary code with elevated privileges. 

Note, the vulnerability does not affect systems when the Windows feature Core Isolation Memory Integrity is enabled. Lenovo systems preloaded with Windows 11 have this feature enabled by default.

Install updates from vendor's website.