This vulnerability arises from improper handling of symbolic links or similar link types before accessing files in Lenovo Diagnostics and the HardwareScanAddin component of Lenovo Vantage. A local authenticated user could exploit this flaw to perform arbitrary file writes with elevated privileges, potentially leading to privilege escalation or unauthorized modification of system files. The CVSS 4.0 base score is 6.9, reflecting a medium severity with local attack vector, low attack complexity, no user interaction required, and high impact on integrity and availability. No official remediation or patch has been disclosed by Lenovo as of the publication date.

A local authenticated attacker could leverage this vulnerability to write arbitrary files with elevated privileges, which may result in privilege escalation or unauthorized system modifications. The impact affects system integrity and availability but requires local access and authentication, limiting remote exploitation potential. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, limit local user privileges to trusted users only and monitor for unusual local activity related to Lenovo Diagnostics or HardwareScanAddin. Avoid running these components with elevated privileges unless necessary.