CVE-2026-63425

Analyzed Analyzed - Analysis Complete

Improper Permissions in Lenovo Dock Manager Leading to Privilege Escalation

Publication date: 2026-08-13

Last updated on: 2026-09-10

Assigner: Lenovo Group Ltd.

Description

During an internal security assessment, a potential improper permissions vulnerability was discovered in Lenovo Dock Manager that could allow a local authenticated user to execute arbitrary code with elevated privileges.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-13

Last Modified

2026-09-10

Generated

2026-09-23

AI Q&A

2026-08-13

EPSS Evaluated

2026-09-21

NVD

CVE-2026-63425

EUVD

EUVD-2026-58058

Affected Vendors & Products

Vendor	Product	Version / Range
lenovo	dock_manager	to 1.6.5.3 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-276	During installation, installed file permissions are set to allow anyone to modify those files.

Attack-Flow Graph

Executive Summary

This vulnerability is an improper permissions issue in Lenovo Dock Manager that allows a local authenticated user to run arbitrary code with elevated privileges. This means an attacker with access to the system could gain higher-level permissions than intended.

Detection Guidance

This vulnerability involves improper permissions in Lenovo Dock Manager allowing local authenticated users to execute arbitrary code with elevated privileges. Detection requires checking file permissions and installed versions of Lenovo Dock Manager on affected systems.

Impact Analysis

If exploited, this flaw could let an attacker take control of your system, install malware, steal data, or perform other malicious actions with elevated privileges. It primarily affects systems using Lenovo Dock Manager.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, which may violate compliance requirements under GDPR, HIPAA, or other regulations. Organizations must address it to maintain data protection standards.

Mitigation Strategies

Update Lenovo Dock Manager to the latest version as soon as patches are released by Lenovo. Restrict local user permissions to minimize the risk of exploitation. Monitor system logs for unusual activity related to Dock Manager processes.

Hi! I’m here to help you understand CVE-2026-63425. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70