CVE-2022-3699

A privilege escalation vulnerability was reported in the Lenovo HardwareScanPlugin prior to version 1.3.1.2 and Lenovo Diagnostics prior to version 4.45 that could allow a local user to execute code with elevated privileges.

Affected

Lenovo · HardwareScanPlugin · Diagnostics

CVSS v3.1 NVD

7.8 HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

4.25% chance of exploitation in the next 30 days, 91st percentile

Published

2023-10-24

Updated

2024-09-17

Proof-of-concept exploits (4)

• Eap2468/CVE-2022-36990★ · 2024-08-21
• alfarom256/CVE-2022-3699178★ · 2022-12-05
• estimated1337/lenovo_exec73★ · 2022-12-27
• vmpprotect/vulnerable-driver-boilerplate9★ · 2026-09-28

Metasploit modules (1)

• rapid7/metasploit-framework/blob/master/modules/exploits/windows/local/cve_2022_3699_leno…

Exploit collections (1)

• CVE-2022-3699helloexp/0day

Security advisories

• https://support.lenovo.com/us/en/product_security/LEN-102365
• https://support.lenovo.com/us/en/product_security/LEN-94532

References

• CVE Record
• NVD entry

Related

• CVE-2021-21551
• CVE-2022-45451
• CVE-2023-32673