Lenovo vulnerabilities1 known to be exploited.
Lenovo has 388 published vulnerabilities across 4,562 products in our catalogue. 1 of them is on the list of flaws known to be exploited, so criminals are using them now. The most affected product is Thinkcentre M625q, with 28. If you run Lenovo software, patch the exploited flaws first.
The most recent Lenovo flaw added to the known-exploited list is CVE-2017-5638, on 3 November 2021. We keep watching the known-exploited list.
Which Lenovo products have the most vulnerabilities?
Thinkcentre M625q leads with 28 published vulnerabilities. Open a product to see its versions and which of its flaws criminals are already using.
Which Lenovo vulnerabilities are being exploited?
1 flaw is on the government list of vulnerabilities known to be exploited. These are the ones criminals are using now, so they go first, whatever their severity score says.
- 9.8Apache Struts Remote Code Execution Vulnerability
Apache Struts Jakarta Multipart parser allows for malicious file upload using the Content-Type value, leading to remote code execution.
Which Lenovo flaws are most likely to be used?
Ranked by the latest exploit-likelihood forecast: the chance each flaw is used in an attack in the next 30 days. A high severity score on its own doesn't tell you that. Flaws shared by many other makers' products are left out.
- >99%
The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception handling and error-message generation during file-upload attempts, which allows remote attackers...
- 9.8%CVE-2017-15361Medium
The Infineon RSA library 1.02.013 in Infineon Trusted Platform Module (TPM) firmware, such as versions before 0000000000000422 - 4.34, before 000000000000062b - 6.43, and before 0000000000008521 - 133.33, mishandles...
- 6.4%CVE-2013-1361Critical
Untrusted search path vulnerability in Lenovo Thinkpad Bluetooth with Enhanced Data Rate Software 6.4.0.2900 and earlier allows local users, and possibly remote attackers, to execute arbitrary code and conduct DLL...
- 5.1%CVE-2016-8106Medium
A Denial of Service in Intel Ethernet Controller's X710/XL710 with Non-Volatile Memory Images before version 5.05 allows a remote attacker to stop the controller from processing network traffic working under certain...
- 4.6%CVE-2007-2928Medium
Format string vulnerability in the IBM Lenovo Access Support acpRunner ActiveX control, as distributed in acpcontroller.dll before 1.2.8.0 and possibly acpir.dll before 1.0.0.9 (Automated Solutions 1.0 before fix...
- 4.2%CVE-2022-3699High
A privilege escalation vulnerability was reported in the Lenovo HardwareScanPlugin prior to version 1.3.1.2 and Lenovo Diagnostics prior to version 4.45 that could allow a local user to execute code with elevated...
- 4.2%CVE-2017-3761Critical
The Lenovo Service Framework Android application executes some system commands without proper sanitization of external input.
- 4.1%CVE-2015-2219High
Lenovo System Update (formerly ThinkVantage System Update) before 5.06.0034 uses predictable security tokens, which allows local users to gain privileges by sending a valid token with a command to the System Update...
- 4.1%CVE-2018-9075High
For some Iomega, Lenovo, LenovoEMC NAS devices versions 4.1.402.34662 and earlier, when joining a PersonalCloud setup, an attacker can craft a command injection payload using backtick "``" characters in the...
- 3.8%CVE-2017-17833Critical
OpenSLP releases in the 1.0.2 and 1.1.0 code streams have a heap-related memory corruption issue which may manifest itself as a denial-of-service or a remote code-execution vulnerability.
All Lenovo products we track.
454 products, most vulnerabilities first. Find the ones you run, then open a product to see its versions and exploited flaws.
- Thinkcentre M625q Firmwarethinkcentre_m625q_firmware28 vulnerabilities2 versions
- Ideacentre 5-14iob6 Firmwareideacentre_5-14iob6_firmware27 vulnerabilities3 versions
- Ideacentre G5-14imb05 Firmwareideacentre_g5-14imb05_firmware27 vulnerabilities2 versions
- Ideacentre Gaming 5-14iob6 Firmwareideacentre_gaming_5-14iob6_firmware27 vulnerabilities3 versions
- Thinkcentre M75n Firmwarethinkcentre_m75n_firmware27 vulnerabilities2 versions
- V50t-13imb Firmwarev50t-13imb_firmware27 vulnerabilities2 versions
- Xclarity Administratorxclarity_administrator27 vulnerabilities20 versions
- Ideacentre 3-07imb05 Firmwareideacentre_3-07imb05_firmware26 vulnerabilities3 versions
- Ideacentre C5-14imb05 Firmwareideacentre_c5-14imb05_firmware26 vulnerabilities2 versions
- Ideacentre Creator 5-14iob6 Firmwareideacentre_creator_5-14iob6_firmware26 vulnerabilities2 versions
- Thinkcentre M75s Gen 2 Firmwarethinkcentre_m75s_gen_2_firmware26 vulnerabilities6 versions
- Thinkcentre M75t Gen 2 Firmwarethinkcentre_m75t_gen_2_firmware26 vulnerabilities7 versions
- V30a-22iml Firmwarev30a-22iml_firmware26 vulnerabilities2 versions
- V50s-07imb Firmwarev50s-07imb_firmware26 vulnerabilities3 versions
- Ideacentre 3-07ada05 Firmwareideacentre_3-07ada05_firmware25 vulnerabilities4 versions
- Ideacentre G5-14amr05 Firmwareideacentre_g5-14amr05_firmware25 vulnerabilities2 versions
- Legion T7-34imz5 Firmwarelegion_t7-34imz5_firmware25 vulnerabilities5 versions
- Thinkcentre M70c Firmwarethinkcentre_m70c_firmware25 vulnerabilities2 versions
- Thinkcentre M70q Firmwarethinkcentre_m70q_firmware25 vulnerabilities2 versions
- Thinkcentre M80q Firmwarethinkcentre_m80q_firmware25 vulnerabilities2 versions
- Thinkcentre M80s Firmwarethinkcentre_m80s_firmware25 vulnerabilities4 versions
- Thinkcentre M80t Firmwarethinkcentre_m80t_firmware25 vulnerabilities4 versions
- Thinkcentre M90a Firmwarethinkcentre_m90a_firmware25 vulnerabilities2 versions
- Thinkcentre M90q Tiny Firmwarethinkcentre_m90q_tiny_firmware25 vulnerabilities2 versions
This directory lists the 454 Lenovo products with at least one tracked version, of 4,562 in our catalogue.
Running Lenovo? We'll keep checking.
Looking flaws up one at a time doesn't scale. Tell us what you run once, and we tell you which flaws matter to you, in what order, and keep watching for new ones.
- Tell us what you runPick your software from a list, or let us work it out from your website.
- We match it to every flawOver 400,000 published flaws, checked against your list.
- Ranked by real-world riskA 0 to 100 score, led by evidence criminals are using it.
- Told as soon as we knowAn alert by email, in the app or by webhook to your own tools.
Free plan, no card needed. Nothing to install.
1 flaw being exploited affects software Acme tracks
Apache Struts Jakarta Multipart parser allows for malicious file upload using the Content-Type value, leading to remote code execution.
- Matched to
- Lenovo on Acme's software list
- What to do
- Patch first, then check for signs of use
Sent to the alert recipients Acme chose. Also in the app and to Acme's webhook.
Our catalogue lists 388 published vulnerabilities across 4,562 products and 2,550 versions from Lenovo. The most recent Lenovo flaw added to the known-exploited list is CVE-2017-5638, on 3 November 2021.
1 Lenovo vulnerability is on the list of flaws known to be exploited. The most recently added is CVE-2017-5638. The full list is on this page.
Thinkcentre M625q, with 28 published vulnerabilities. Its own page lists the ones known to be exploited.
Create a Precursor Intelligence account and track the Lenovo products you run. We match them against every published flaw, give each one a risk score from 0 to 100 and tell you as soon as we spot one that affects you, by email, in the app or by webhook.