CVE-2025-12048: Lenovo Scanner Pro RCE Vulnerability

CVE-2025-12048 Overview

CVE-2025-12048 is an arbitrary file upload vulnerability in the Lenovo Scanner Pro client. Lenovo identified the issue during an internal security assessment and published advisory #434326. Attackers on an adjacent network can upload arbitrary files to vulnerable installations. Successful exploitation leads to remote code execution or unauthorized control of the affected system. The flaw is classified under [CWE-434] Unrestricted Upload of File with Dangerous Type. No authentication or user interaction is required, but the attacker must be on the adjacent network.

Critical Impact
Adjacent-network attackers can upload arbitrary files to the Lenovo Scanner Pro client and achieve remote code execution, compromising confidentiality, integrity, and availability of the host.

Affected Products

Lenovo Scanner Pro client (vulnerable versions per Lenovo Security Advisory #434326)
Windows systems running the Lenovo Scanner Pro client
Endpoints reachable on the same adjacent network segment as the scanner client

Discovery Timeline

2025-11-12 - CVE-2025-12048 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-12048

Vulnerability Analysis

The Lenovo Scanner Pro client exposes a file upload interface that does not properly restrict the type, name, or destination of uploaded files. An attacker on the same adjacent network can submit a crafted upload request and place an executable payload into a location processed or executed by the client. The advisory describes the outcome as remote code execution or unauthorized control of the affected system. The attack vector is adjacent network, attack complexity is low, and no privileges or user interaction are required.

Root Cause

The vulnerability stems from missing or insufficient validation on the file upload handler within the Lenovo Scanner Pro client, consistent with [CWE-434]. The client accepts files without enforcing allowlists for extensions, MIME types, or content inspection. It also fails to constrain the upload destination, allowing attacker-controlled content to land in a directory where it can be executed or auto-loaded.

Attack Vector

An attacker positioned on the adjacent network sends a crafted request to the Lenovo Scanner Pro client's upload endpoint. The request delivers an executable payload, such as a script or binary, under an attacker-chosen filename. Once written, the file is executed by the client or by an automatic process, granting the attacker code execution in the security context of the running client.

No public proof-of-concept code is available. Refer to the Lenovo Security Advisory #434326 for technical specifics.

Detection Methods for CVE-2025-12048

Indicators of Compromise

Unexpected files written to Lenovo Scanner Pro installation or working directories, especially executables, scripts, or DLLs.
Child processes spawned by the Lenovo Scanner Pro client process that are uncommon for scanner workflows, such as cmd.exe, powershell.exe, or rundll32.exe.
Inbound connections to the Scanner Pro client from non-management hosts on the local network segment.
New scheduled tasks, services, or autorun entries created shortly after Scanner Pro activity.

Detection Strategies

Monitor file creation events under the Lenovo Scanner Pro install directory and alert on writes of .exe, .dll, .bat, .ps1, or .vbs files.
Build process lineage rules that flag the Scanner Pro client as a parent of shell or scripting interpreters.
Inspect network telemetry for unsolicited inbound traffic to the Scanner Pro listening ports from same-subnet peers.

Monitoring Recommendations

Enable command-line and process creation logging on Windows hosts running the client and forward to a centralized SIEM.
Correlate file write, process execution, and network connection events to surface upload-to-execute chains.
Track outbound connections from the Scanner Pro process to identify command-and-control activity after exploitation.

How to Mitigate CVE-2025-12048

Immediate Actions Required

Apply the fixed version of the Lenovo Scanner Pro client as soon as it is published in Lenovo Security Advisory #434326.
Inventory all endpoints running Lenovo Scanner Pro and prioritize patching on systems exposed to shared or untrusted network segments.
Restrict access to the Scanner Pro client's listening interfaces to trusted management hosts using host-based firewall rules.
Audit Scanner Pro installation directories for unexpected files and remove any that cannot be attributed to legitimate use.

Patch Information

Lenovo published advisory #434326 documenting the vulnerability. Consult the advisory for the list of fixed builds and download locations. Deploy the vendor-supplied update across all affected endpoints. The CVE was published on 2025-11-12 and last modified on 2026-06-17.

Workarounds

Isolate hosts running the Scanner Pro client onto management VLANs that exclude untrusted user devices.
Disable or uninstall the Lenovo Scanner Pro client on systems where scanner functionality is not required.
Enforce 802.1X or network access control to limit which devices can reach the same broadcast domain as scanner-equipped hosts.

bash

# Windows host firewall example: restrict Scanner Pro listener to a trusted management subnet
netsh advfirewall firewall add rule name="Lenovo Scanner Pro - Restrict" \
    dir=in action=block program="C:\Program Files\Lenovo\ScannerPro\ScannerPro.exe" \
    enable=yes profile=any
netsh advfirewall firewall add rule name="Lenovo Scanner Pro - Allow Mgmt" \
    dir=in action=allow program="C:\Program Files\Lenovo\ScannerPro\ScannerPro.exe" \
    remoteip=10.10.50.0/24 enable=yes profile=any