High severity · published Jan 26, 2017
CVE-2016-8225
Unquoted service path vulnerability in Lenovo Edge and Lenovo Slim USB Keyboard Driver versions earlier than 1.21 allows local users to execute code with elevated privileges
7.8
CVSS
0.4%
EPSS
No
On KEV
Description
Unquoted service path vulnerability in Lenovo Edge and Lenovo Slim USB Keyboard Driver versions earlier than 1.21 allows local users to execute code with elevated privileges.
CVSS vector
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 29% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EA
Edge and Slim USB Keyboard Driver · Lenovo Group Ltd.
Earlier than 1.21 · source: vendor
EK
Edge Keyboard Driver · Lenovo
through 1.20 · source: NVD
SU
Slim Usb Keyboard Driver · Lenovo
through 1.20 · source: NVD
Affected product
EA
Edge and Slim USB Keyboard Driver
Lenovo Group Ltd.