CVE-2026-1715: Lenovo Vantage Privilege Escalation Flaw

CVE-2026-1715 Overview

CVE-2026-1715 is an input validation vulnerability in the DeviceSettingsSystemAddin component used by Lenovo Vantage and Lenovo Baiying. A local authenticated user can abuse the flaw to modify arbitrary Windows registry keys with elevated privileges. The issue is tracked under CWE-88: Improper Neutralization of Argument Delimiters in a Command and affects systems where Lenovo Vantage or Baiying is installed as a privileged service component.

Critical Impact

A low-privileged local user can write to arbitrary registry keys in the context of the elevated Lenovo service, enabling configuration tampering, persistence, and local privilege escalation on affected Windows endpoints.

Affected Products

• Lenovo Vantage (versions prior to the fix referenced in Lenovo Security Advisory LEN-213044)
• Lenovo Baiying (as referenced in Lenovo Security Detail #438815)
• Windows endpoints running the vulnerable DeviceSettingsSystemAddin component

Discovery Timeline

• 2026-03-11 - CVE-2026-1715 published to the National Vulnerability Database
• 2026-03-25 - Last updated in NVD database

Technical Details for CVE-2026-1715

Vulnerability Analysis

The flaw resides in the DeviceSettingsSystemAddin add-in shipped with Lenovo Vantage and Lenovo Baiying. This add-in runs as a privileged helper that exposes registry-modification functionality to lower-privileged user-mode components. Because the component fails to properly validate or neutralize argument delimiters supplied by callers, a local authenticated user can supply crafted parameters that the privileged process interprets as instructions to write to registry locations the user could not normally reach.

The practical effect is an arbitrary registry write primitive executed under the security context of the Lenovo service. Attackers can leverage this primitive to alter security-relevant configuration, install persistence under autorun keys, or weaponize the write into a full local privilege escalation by modifying keys consumed by SYSTEM-level processes.

Root Cause

The root cause is improper neutralization of argument delimiters [CWE-88] in the inter-process interface exposed by DeviceSettingsSystemAddin. Untrusted input from the caller is concatenated into a privileged operation without strict allow-listing of target registry paths or sanitization of delimiter characters, allowing the caller to influence operations outside the intended scope.

Attack Vector

Exploitation requires local access and a low-privileged authenticated session on the target host. No user interaction is needed beyond the attacker's own actions. The attacker invokes the vulnerable add-in's exported functionality through its supported IPC channel and supplies crafted arguments that redirect the privileged registry write to an attacker-chosen key and value. Successful exploitation yields integrity and availability impact on the host while confidentiality remains largely unaffected.

No public proof-of-concept exploit is currently available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2026-1715

Indicators of Compromise

• Unexpected child processes or registry-modification activity spawned by Lenovo Vantage or Lenovo Baiying service binaries, particularly those hosting DeviceSettingsSystemAddin.
• New or modified values under sensitive registry hives such as HKLM\SYSTEM\CurrentControlSet\Services, HKLM\Software\Microsoft\Windows\CurrentVersion\Run, or Image File Execution Options keys originating from the Lenovo service context.
• Standard user accounts triggering registry writes to HKLM paths through the Lenovo add-in process tree.

Detection Strategies

• Monitor Windows Security event ID 4657 (registry value modification) where the calling process is a Lenovo Vantage or Baiying service and the target key is outside expected device-settings paths.
• Hunt for Sysmon event ID 13 (RegistryEvent SetValue) sourced from DeviceSettingsSystemAddin host processes writing to autorun, service, or policy keys.
• Correlate non-administrative user sessions with elevated registry writes performed by Lenovo service binaries to surface privilege-boundary violations.

Monitoring Recommendations

• Inventory hosts with Lenovo Vantage or Baiying installed and confirm the running version against the fixed build listed in Lenovo Security Advisory LEN-213044.
• Baseline normal registry write behavior of the Lenovo add-in and alert on deviations such as writes to security-sensitive hives.
• Forward registry, process, and IPC telemetry to a centralized analytics platform to enable cross-host correlation and retrospective hunting.

How to Mitigate CVE-2026-1715

Immediate Actions Required

• Update Lenovo Vantage and Lenovo Baiying to the fixed versions identified in the vendor advisories before taking other actions.
• Restrict local logon and interactive access on managed endpoints to reduce the population of users able to invoke the vulnerable add-in.
• Audit recent registry modifications attributable to the Lenovo service to identify any pre-patch abuse on sensitive systems.

Patch Information

Lenovo has released fixed builds documented in Lenovo Security Advisory LEN-213044 and Lenovo Security Detail #438815. Administrators should deploy the patched version of Lenovo Vantage and Lenovo Baiying through Microsoft Store updates, enterprise software distribution, or Lenovo's standard update channels. Verify the installed version of DeviceSettingsSystemAddin matches or exceeds the version specified in the advisory after deployment.

Workarounds

• Where patching is not immediately possible, uninstall Lenovo Vantage and Lenovo Baiying on systems that do not require their functionality.
• Disable or stop the Lenovo system service hosting DeviceSettingsSystemAddin to remove the privileged attack surface until updates are applied.
• Apply least-privilege controls and remove unnecessary local user accounts from endpoints exposed to untrusted operators.

# Configuration example: identify installed Lenovo Vantage version on Windows endpoints
Get-AppxPackage -AllUsers -Name "*LenovoVantage*" | Select-Object Name, Version, PackageFullName

# Stop and disable the Lenovo system service hosting the vulnerable add-in (example service name)
Stop-Service -Name "LenovoVantageService" -Force
Set-Service -Name "LenovoVantageService" -StartupType Disabled