Security readout for executives and security teams
Plain-English summary
Some Lenovo installation packages before version 1.2.9.3 could load a DLL from an unsafe location during installation. The reported impact is privilege escalation, but exploitation is local, high-complexity, and requires installation activity. This is not listed as known exploited in the provided data.
Executive priority
Treat as a controlled remediation item, not an emergency. Prioritize environments that routinely deploy Lenovo packages or keep old installers in shared repositories. The main business risk is avoidable endpoint privilege escalation during trusted installation workflows.
Technical view
CVE-2019-6173 is a CWE-426 untrusted search path issue in unspecified Lenovo installation packages before 1.2.9.3. CVSS 3.1 is 6.7 with local attack vector, high complexity, low privileges, and user interaction. The description also states the attacker already has administrative privileges, so privilege assumptions need validation against Lenovo guidance.
Likely exposure
Exposure is most likely where organizations retain or run older Lenovo installation packages below 1.2.9.3. The bundle does not identify exact package names, deployment channels, or CPEs, so inventory must be matched against Lenovo’s advisory rather than broad Lenovo ownership.
Exploitation context
The provided sources do not show active exploitation or KEV listing. Exploitation requires local conditions and installation activity, with high complexity. The description’s administrative-privilege prerequisite limits broad remote risk but may still matter for endpoint hardening and controlled software deployment.
Researcher notes
Key gaps are the unspecified affected package list and the tension between CVSS PR:L and the description requiring administrative privileges. Do not assume broader Lenovo product exposure from this record alone. Use Lenovo LEN-27431 as the authoritative source for package identification and remediation details.
Mitigation direction
- Review Lenovo advisory LEN-27431 for exact package names and fixed versions.
- Replace affected Lenovo installation packages with version 1.2.9.3 or later where applicable.
- Remove obsolete Lenovo installer packages from software shares and endpoint caches.
- Restrict who can run administrative software installations.
- Monitor vendor guidance for any clarified affected package list.
Validation and detection
- Inventory Lenovo installation packages retained in deployment tools and file shares.
- Confirm package versions are not earlier than 1.2.9.3.
- Check endpoint build processes for use of archived Lenovo installers.
- Verify administrative installation rights are limited and logged.
- Document any remaining unknown Lenovo packages for vendor follow-up.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-426: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupPrivilege behavior lookup
The CVE wording references privilege impact, so privilege escalation and authorization behavior review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2019-6173 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 6.7 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H0.85.9Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
6.7MediumVector: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
Source materials
- CVE List V5 sourceCVE List V5
- https://support.lenovo.com/us/en/product_security/len-27431CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Untrusted Search Path
Untrusted Search Path represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.