A vulnerability was reported in Lenovo System Update that could allow a local user with interactive system access the ability to execute co…

published 2022-04-22 4 y ago modified 2026-06-17 4 mo ago also EUVD-2022-15511

cvss: 7.3; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.3%; EPSS 0.3% chance of exploitation in 30 days, percentile 16%
public exploits: 0; none known

A vulnerability was reported in Lenovo System Update that could allow a local user with interactive system access the ability to execute code with elevated privileges only during the installation of a System Update package released before 2022-02-25 that displays a command prompt window.

Patch / fix

fixed in 1

lenovo system_update 2022-02-25

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: total
Assessed: 5 mo ago (2026-06-02)

Exploit prediction

0.25% chance of exploitation in the next 30 days, higher than 16% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

infosec.tirol https://www.infosec.tirol/cve-2022-0354/ referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
CNA	3.1	7.3	CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
NVD	3.1	7.8	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD	2.0	7.2	AV:L/AC:L/Au:N/C:C/I:C/A:C

Affected products

Lenovo System Update

Classification

Weakness

CWE-317 Cleartext Storage of Sensitive Information in GUI

References

infosec.tirol /cve-2022-0354/
exploit, third-party-advisory
support.lenovo.com /us/en/product_security/LEN-76673
vendor-advisory

Sources

CVE List CVE-2022-0354
NVD CVE-2022-0354

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary