Vulnerability-Lookup

VAR-201606-0144

Vulnerability from variot - Updated: 2025-04-12 23:04

Lenovo Solution Center (LSC) before 3.3.003 allows local users to execute arbitrary code with LocalSystem privileges via vectors involving the LSC.Services.SystemService StartProxy command with a named pipe created in advance and crafted .NET assembly. Lenovo Solution Center is prone to local privilege-escalation and arbitrary code-execution vulnerabilities. Lenovo Solution Center 3.3.002 and prior versions are vulnerable. Lenovo Solution Center (LSC) is a set of software developed by China Lenovo (Lenovo) to help users quickly identify system health status, network connection and overall system security status. Arbitrary code execution vulnerabilities exist in versions prior to LSC 3.3.003

Show details on source website

JSON

To clipboard

{
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "configurations": {
      "@id": "https://www.variotdbs.pl/ref/configurations"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-201606-0144",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "solution center",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "lenovo",
        "version": "3.3.002"
      },
      {
        "model": "solution center",
        "scope": "lt",
        "trust": 0.8,
        "vendor": "lenovo",
        "version": "3.3.003"
      },
      {
        "model": "solution center",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "lenovo",
        "version": "3.3.002"
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2016-003376"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201606-663"
      },
      {
        "db": "NVD",
        "id": "CVE-2016-5249"
      }
    ]
  },
  "configurations": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/configurations#",
      "children": {
        "@container": "@list"
      },
      "cpe_match": {
        "@container": "@list"
      },
      "data": {
        "@container": "@list"
      },
      "nodes": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "cpe_match": [
              {
                "cpe22Uri": "cpe:/a:lenovo:solution_center",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2016-003376"
      }
    ]
  },
  "credits": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/credits#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Martin Rakhmanov of Trustwave",
    "sources": [
      {
        "db": "BID",
        "id": "91454"
      }
    ],
    "trust": 0.3
  },
  "cve": "CVE-2016-5249",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [
          {
            "accessComplexity": "LOW",
            "accessVector": "LOCAL",
            "authentication": "NONE",
            "author": "nvd@nist.gov",
            "availabilityImpact": "COMPLETE",
            "baseScore": 7.2,
            "confidentialityImpact": "COMPLETE",
            "exploitabilityScore": 3.9,
            "id": "CVE-2016-5249",
            "impactScore": 10.0,
            "integrityImpact": "COMPLETE",
            "severity": "HIGH",
            "trust": 1.8,
            "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C",
            "version": "2.0"
          },
          {
            "accessComplexity": "LOW",
            "accessVector": "LOCAL",
            "authentication": "NONE",
            "author": "VULHUB",
            "availabilityImpact": "COMPLETE",
            "baseScore": 7.2,
            "confidentialityImpact": "COMPLETE",
            "exploitabilityScore": 3.9,
            "id": "VHN-94068",
            "impactScore": 10.0,
            "integrityImpact": "COMPLETE",
            "severity": "HIGH",
            "trust": 0.1,
            "vectorString": "AV:L/AC:L/AU:N/C:C/I:C/A:C",
            "version": "2.0"
          }
        ],
        "cvssV3": [
          {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "author": "nvd@nist.gov",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "exploitabilityScore": 1.8,
            "id": "CVE-2016-5249",
            "impactScore": 5.9,
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "trust": 1.8,
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          }
        ],
        "severity": [
          {
            "author": "nvd@nist.gov",
            "id": "CVE-2016-5249",
            "trust": 1.0,
            "value": "HIGH"
          },
          {
            "author": "NVD",
            "id": "CVE-2016-5249",
            "trust": 0.8,
            "value": "High"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-201606-663",
            "trust": 0.6,
            "value": "HIGH"
          },
          {
            "author": "VULHUB",
            "id": "VHN-94068",
            "trust": 0.1,
            "value": "HIGH"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-94068"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2016-003376"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201606-663"
      },
      {
        "db": "NVD",
        "id": "CVE-2016-5249"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Lenovo Solution Center (LSC) before 3.3.003 allows local users to execute arbitrary code with LocalSystem privileges via vectors involving the LSC.Services.SystemService StartProxy command with a named pipe created in advance and crafted .NET assembly. Lenovo Solution Center is prone to local privilege-escalation and arbitrary code-execution vulnerabilities. \nLenovo Solution Center 3.3.002 and prior versions are vulnerable. Lenovo Solution Center (LSC) is a set of software developed by China Lenovo (Lenovo) to help users quickly identify system health status, network connection and overall system security status. Arbitrary code execution vulnerabilities exist in versions prior to LSC 3.3.003",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2016-5249"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2016-003376"
      },
      {
        "db": "BID",
        "id": "91454"
      },
      {
        "db": "VULHUB",
        "id": "VHN-94068"
      }
    ],
    "trust": 1.98
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "NVD",
        "id": "CVE-2016-5249",
        "trust": 2.8
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2016-003376",
        "trust": 0.8
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201606-663",
        "trust": 0.7
      },
      {
        "db": "BID",
        "id": "91454",
        "trust": 0.3
      },
      {
        "db": "VULHUB",
        "id": "VHN-94068",
        "trust": 0.1
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-94068"
      },
      {
        "db": "BID",
        "id": "91454"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2016-003376"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201606-663"
      },
      {
        "db": "NVD",
        "id": "CVE-2016-5249"
      }
    ]
  },
  "id": "VAR-201606-0144",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-94068"
      }
    ],
    "trust": 0.01
  },
  "last_update_date": "2025-04-12T23:04:18.797000Z",
  "patch": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/patch#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "title": "LEN-7814",
        "trust": 0.8,
        "url": "https://support.lenovo.com/jp/ja/product_security/len_7814"
      },
      {
        "title": "Lenovo Solution Center Fixes for arbitrary code execution vulnerabilities",
        "trust": 0.6,
        "url": "http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=62572"
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2016-003376"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201606-663"
      }
    ]
  },
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "CWE-264",
        "trust": 1.9
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-94068"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2016-003376"
      },
      {
        "db": "NVD",
        "id": "CVE-2016-5249"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 1.7,
        "url": "https://www.trustwave.com/resources/security-advisories/advisories/twsl2016-012/?fid=8073"
      },
      {
        "trust": 1.1,
        "url": "https://support.lenovo.com/us/en/product_security/len_7814"
      },
      {
        "trust": 0.8,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2016-5249"
      },
      {
        "trust": 0.8,
        "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2016-5249"
      },
      {
        "trust": 0.6,
        "url": "https://support.lenovo.com/us/zh/product_security/len_7814"
      },
      {
        "trust": 0.3,
        "url": "http://www.lenovo.com/ca/en/"
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-94068"
      },
      {
        "db": "BID",
        "id": "91454"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2016-003376"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201606-663"
      },
      {
        "db": "NVD",
        "id": "CVE-2016-5249"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "VULHUB",
        "id": "VHN-94068"
      },
      {
        "db": "BID",
        "id": "91454"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2016-003376"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201606-663"
      },
      {
        "db": "NVD",
        "id": "CVE-2016-5249"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2016-06-30T00:00:00",
        "db": "VULHUB",
        "id": "VHN-94068"
      },
      {
        "date": "2016-06-27T00:00:00",
        "db": "BID",
        "id": "91454"
      },
      {
        "date": "2016-07-04T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2016-003376"
      },
      {
        "date": "2016-06-30T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201606-663"
      },
      {
        "date": "2016-06-30T16:59:08.117000",
        "db": "NVD",
        "id": "CVE-2016-5249"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2016-07-01T00:00:00",
        "db": "VULHUB",
        "id": "VHN-94068"
      },
      {
        "date": "2016-07-06T15:06:00",
        "db": "BID",
        "id": "91454"
      },
      {
        "date": "2016-07-04T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2016-003376"
      },
      {
        "date": "2016-07-01T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201606-663"
      },
      {
        "date": "2025-04-12T10:46:40.837000",
        "db": "NVD",
        "id": "CVE-2016-5249"
      }
    ]
  },
  "threat_type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "local",
    "sources": [
      {
        "db": "BID",
        "id": "91454"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201606-663"
      }
    ],
    "trust": 0.9
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Lenovo Solution Center In  LocalSystem Vulnerability to execute arbitrary code with privileges",
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2016-003376"
      }
    ],
    "trust": 0.8
  },
  "type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "permissions and access control",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201606-663"
      }
    ],
    "trust": 0.6
  }
}

CVE-2016-5249 (GCVE-0-2016-5249)

Vulnerability from cvelistv5 – Published: 2016-06-30 16:00 – Updated: 2024-08-06 00:53

Summary

Severity ?

No CVSS data available.

CWE

Assigner

mitre

References

URL

Tags

	https://support.lenovo.com/us/en/product_security…	x_refsource_CONFIRM
	https://www.trustwave.com/Resources/Security-Advi…	x_refsource_MISC

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T00:53:48.924Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://support.lenovo.com/us/en/product_security/len_7814"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.trustwave.com/Resources/Security-Advisories/Advisories/TWSL2016-012/?fid=8073"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2016-06-23T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Lenovo Solution Center (LSC) before 3.3.003 allows local users to execute arbitrary code with LocalSystem privileges via vectors involving the LSC.Services.SystemService StartProxy command with a named pipe created in advance and crafted .NET assembly."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2016-06-30T15:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://support.lenovo.com/us/en/product_security/len_7814"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.trustwave.com/Resources/Security-Advisories/Advisories/TWSL2016-012/?fid=8073"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2016-5249",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Lenovo Solution Center (LSC) before 3.3.003 allows local users to execute arbitrary code with LocalSystem privileges via vectors involving the LSC.Services.SystemService StartProxy command with a named pipe created in advance and crafted .NET assembly."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://support.lenovo.com/us/en/product_security/len_7814",
              "refsource": "CONFIRM",
              "url": "https://support.lenovo.com/us/en/product_security/len_7814"
            },
            {
              "name": "https://www.trustwave.com/Resources/Security-Advisories/Advisories/TWSL2016-012/?fid=8073",
              "refsource": "MISC",
              "url": "https://www.trustwave.com/Resources/Security-Advisories/Advisories/TWSL2016-012/?fid=8073"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2016-5249",
    "datePublished": "2016-06-30T16:00:00",
    "dateReserved": "2016-06-03T00:00:00",
    "dateUpdated": "2024-08-06T00:53:48.924Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

VAR-201606-0144

CVE-2016-5249 (GCVE-0-2016-5249)

Tags

Sightings

Nomenclature