High severity · published Jan 24, 2019
CVE-2018-16098
In some Lenovo ThinkPads, an unquoted search path vulnerability was found in various versions of the Synaptics Pointing Device driver which could allow unauthorized code execution…
7.8
CVSS
0.4%
EPSS
No
On KEV
Description
In some Lenovo ThinkPads, an unquoted search path vulnerability was found in various versions of the Synaptics Pointing Device driver which could allow unauthorized code execution as a low privilege user.
CVSS vector
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 34% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
VT
Various ThinkPad products · Lenovo Group Ltd.
Various · source: vendor
ST
Synaptics Thinkpad Ultranav Driver · Lenovo
18.0.7.119; 19.5.19.33; 19.0.17.140; 19.3.4.219; 16.2.19.23; 18.1.27.42 · source: NVD
TL
Thiankpad L430 Firmware · Lenovo
All versions, or not specified · source: NVD
TL
Thiankpad L530 Firmware · Lenovo
All versions, or not specified · source: NVD
TP
Thiankpad P1 Firmware · Lenovo
All versions, or not specified · source: NVD
TP
Thiankpad P50s Firmware · Lenovo
All versions, or not specified · source: NVD
TP
Thiankpad P51 Firmware · Lenovo
All versions, or not specified · source: NVD
TP
Thiankpad P51s Firmware · Lenovo
All versions, or not specified · source: NVD
TP
Thiankpad P52s Firmware · Lenovo
All versions, or not specified · source: NVD
TP
Thiankpad P70 Firmware · Lenovo
All versions, or not specified · source: NVD
TS
Thiankpad S1 Yoga Firmware · Lenovo
All versions, or not specified · source: NVD
TS
Thiankpad S430 Firmware · Lenovo
All versions, or not specified · source: NVD