Loading story…
Lenovo disclosed CVE-2025-13154, an improper link following vulnerability in the SmartPerformanceAddin component of Lenovo Vantage that could let an authenticated local user delete arbitrary files with elevated privileges. The company said the flaw could lead to denial of service and privilege escalation, rated it Medium severity, and described the impact as Lenovo-specific. Lenovo credited Alex Lee Tsz Hin of PwCHK and Manuel Kiesel of cyllective AG together with John Ostrowski of Compass Security for reporting the issue.
Lenovo advised customers to update Vantage SmartPerformanceAddin to version 1.1.0.1111 or later, noting that the component is normally updated automatically through Lenovo Vantage. Separate Lenovo and Intel advisories in the same set also reference security issues affecting Intel Ethernet adapters and controllers, including Intel advisory INTEL-SA-00918, indicating ongoing vendor remediation activity across Lenovo-supported hardware and software components.
Get the actors, campaigns, and ATT&CK mapping behind it.
3 events from the most recent confirmed update back to the earliest known activity.
Lenovo published advisory LEN-208293 for CVE-2025-13154, an improper link following flaw in the SmartPerformanceAddin component for Lenovo Vantage that could let an authenticated local user delete arbitrary files with elevated privileges. Lenovo rated the issue Medium severity and advised updating SmartPerformanceAddin to version 1.1.0.1111 or later; the issue was reported by Alex Lee Tsz Hin, Manuel Kiesel, and John Ostrowski.
Intel released security advisory INTEL-SA-00918, disclosing a security issue tracked by Intel in its products. The reference indicates this was an official vendor advisory publication.
Lenovo published security advisory LEN-115703 concerning Intel Ethernet Adapters and the Intel Ethernet Controller I225. The advisory indicates Lenovo disclosed product security information related to affected Intel Ethernet components.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
3 references tracked. Mallory keeps watching after this page renders.
support.lenovo.com
Open sourceintel.com
Open sourcesupport.lenovo.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
SentinelLabs reported that **CVE-2021-21551** affected a Dell BIOS update driver preinstalled on a vast number of consumer and enterprise systems, exposing potentially **hundreds of millions of computers** to local privilege escalation. The issue involved multiple flaws in the `dbutil` driver, which could allow an attacker with local access to escalate privileges to kernel mode, bypass security controls, and execute arbitrary code at the highest level of the operating system. Because the vulnerable driver was broadly distributed through Dell firmware update utilities and support tools, the exposure spanned many device models and persisted even after software updates in some environments. The report warned that successful exploitation could enable attackers to disable security products, maintain persistence, and gain deep control over affected endpoints, prompting the need for driver removal, vendor patches, and verification that vulnerable components were fully remediated across fleets.
Jul 12, 2026
runZero disclosed technical details of **CVE-2024-38508**, a command-injection vulnerability in Lenovo XClarity Controller 2 (XCC2) BMC firmware. An authenticated user with the Operator role and Remote-Media privileges can craft remote-media connection parameters to execute arbitrary commands as `root`, potentially compromising the server’s out-of-band management controller. Lenovo identified, fixed, and disclosed the vulnerability in 2024 through its XClarity Controller security advisory. The issue affects older firmware releases, including version 1.10; current XCC2 firmware version 8.80 is not affected. runZero’s rediscovery was initially assigned `CVE-2026-65201` before being confirmed as a duplicate of `CVE-2024-38508`, underscoring the need to identify and update BMCs that may remain on legacy firmware.
Sep 23, 2026
Intel disclosed multiple vulnerabilities in Linux kernel-mode Ethernet drivers for its **700 Series**, **800 Series**, and **I350 Series** network adapters, warning that authenticated local users could exploit the flaws for **privilege escalation**, **information disclosure**, or **denial of service**. The most severe issue listed in `INTEL-SA-01296` is **CVE-2025-24325**, rated **CVSS 4.0 9.3 Critical**, affecting some Intel 800 Series Ethernet drivers before version `1.17.2`; Intel said the advisory covers eight CVEs tied to improper input validation, insufficient control flow management, exceptional-condition handling, and integer overflow. A separate advisory, `INTEL-SA-01335`, covers Intel 700 Series and I350 Series Linux drivers, including 700 Series flaws such as **CVE-2025-24486**, **CVE-2025-21086**, and **CVE-2025-25273**, which can expose vulnerable kernel code paths in the `i40e` driver and potentially lead to root-level compromise on affected Linux systems. Intel said affected 700 Series driver versions earlier than `2.28.5` and I350 Series driver versions earlier than `5.19.2` should be upgraded, while 800 Series deployments should move to `1.17.2` or later; fixes are also available through the **Intel Ethernet Adapter Complete Driver Pack** version `30.0.1` or later. The impacted hardware spans widely deployed enterprise and cloud platforms, including Intel **I710**, **X710**, **XL710**, **XXV710**, **V710**, **X722**, and multiple Xeon- and Atom-based systems. Intel said the vulnerabilities were discovered internally and released under coordinated disclosure after mitigations became available, and public reporting indicated no proof-of-concept exploit had been released for the highlighted 700 Series issues at the time of publication.
Jun 29, 2026