Launching the Lenovo Solution Center creates a process called

LSCTaskService

, which runs with SYSTEM privileges. This process runs an HTTP daemon on port 55555, which allows HTTP GET and POST requests to execute methods in the

LSCController.dll

module. This component includes a number of unsafe methods, including

RunInstaller

, which is designed to execute arbitrary code from the

%APPDATA%\LSC\Local Store

directory. This directory is created for each user that logs in to an affected system. The user can write to this directory, regardless of whether the account has administrative privileges on the system. This vulnerability can allow a standard local user to execute arbitrary code with SYSTEM privileges.

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Due to a directory traversal vulnerability, Lenovo Solution Center allows an attacker to execute code that resides in an arbitrary location on the drive where user profile directories exist. If an attacker can place arbitrary code in a predictable location on a vulnerable system, this can allow for arbitrary code execution with SYSTEM privileges.

CWE-352: Cross-Site Request Forgery (CSRF)

The

LSCTaskService

component of Lenovo Solution Center contains a CSRF vulnerability. This vulnerability allows web content hosted by any domain to successfully execute requests using the vulnerable service. The CSRF vulnerability in Lenovo Solution Center allows a malicious or compromised web site to be able to cause code execution with SYSTEM privileges on an affected Lenovo system.

Note that all of these vulnerabilities appear to require that the user has launched the Lenovo Solution Center at least once. Simply closing the Lenovo Solution Center does appear to stop the vulnerable

LSCTaskService

process.

Lenovo has provided the following statement:

"Lenovo has released two updated versions of Lenovo Solution Center for different versions of Windows operating systems that address these vulnerabilities. Additional information regarding downloading updated versions can be found on Lenovo Security Advisory: LEN-4326 located here: https://support.lenovo.com/us/en/product_security/len_4326"