Medium severity · published Nov 12, 2025
CVE-2025-8421
An improper default permission vulnerability was reported in Lenovo Dock Manager that, under certain conditions during installation, could allow an authenticated local user to…
6.6
CVSS
0.1%
EPSS
No
On KEV
Description
An improper default permission vulnerability was reported in Lenovo Dock Manager that, under certain conditions during installation, could allow an authenticated local user to redirect log files with elevated privileges.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
None
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.1% · higher than 1% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DM
Dock Manager · Lenovo
before 1.6.5.2 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-8421
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-8421
support.lenovo.com
https://support.lenovo.com/us/en/product_security/LEN-198729
More from Dock Manager
7.8
CVE-2026-63425
During an internal security assessment, a potential improper permissions vulnerability was discovered in Lenovo Dock Manager that could allow a local authenticated user to execute…
7.3
CVE-2026-63424
During an internal security assessment, an improperly protected key was discovered in Lenovo Dock Manager that could allow a local authenticated user to escalate privileges
7.1
CVE-2026-63426
During an internal security assessment, a potential vulnerability was discovered in Lenovo Dock Manager that could allow an authenticated local user to perform an arbitrary file…