01 Record

CVE-2025-0886

An incorrect permissions vulnerability was reported in Elliptic Labs Virtual Lock Sensor that could allow a local, authenticated user to escalate privileges.

HighPUBLISHEDCNA: lenovo

CNA base score8.5 CVSS v4.0CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

View raw JSON

02 Description

An incorrect permissions vulnerability was reported in Elliptic Labs Virtual Lock Sensor that could allow a local, authenticated user to escalate privileges.

03 Exploitation and scoring

Exploitation

Assessed, none found. CISA's assessment recorded neither public exploit code nor evidence of exploitation when it was made.

SSVC decision

ExploitationnoneCISA recorded no public exploit code and no evidence of exploitation.
AutomatablenoAt least one step from reconnaissance to exploitation cannot be reliably automated.
Technical ImpacttotalSuccessful exploitation gives total control of the vulnerable component.

CISA publishes the decision points, not a final SSVC decision. The decision also depends on mission and well-being impact, which is a property of your deployment rather than of the vulnerability.

EPSS probability

0.19% probability of exploitation activity in the next 30 days.

EPSS percentile

Equal to or higher than the score of 9.4% of scored records. A rank, not a probability.

NVD base score

8.5 (CVSS v4.0), scored by the NVD independently of the CNA.

NVD CVSS vector

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

NVD analysis status

Deferred. NVD last modified this record on 2026-06-17.

Red Hat severity

No Red Hat rating. Red Hat rates the CVEs that affect its products.

Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.

04 Metadata

Published

2025-07-17 19:16Z1 YR AGO

Last updated

2025-07-17 20:09Z1 YR AGO

Reserved

2025-01-30

Assigning CNA

lenovo

Record state

PUBLISHED

Severity

High (CVSS 8.5)

CNA CVSS vector

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Weaknesses

CWE-276Incorrect Default PermissionsBase

Data version

5.1

Document digest

8d20350d76b35c63b5757f35c350c09efe5f792330ec4448f25e424b08c76411

05 Affected products

VendorProductVersionsPlatforms

LenovoElliptic Virtual Lock Sensor Service For ThinkPad P1 Gen 6 (Type 21FV, 21FW)0 to < 1000.100.108.548—

LenovoElliptic Human Presence Detection Driver for ThinkPad P1 Gen 7 (Type 21KV, 21KW)0 to < 1000.100.108.801—

LenovoElliptic Virtual Lock Sensor Service for P14s Gen 4 (Type 21HF, 21HG)0 to < 1000.100.108.858—

LenovoElliptic Human Presence Detection Device Driver for ThinkPad P14s Gen 4 (Type 21K5, 21K6)0 to < 1000.100.108.1893—

LenovoElliptic Human Presence Detection Driver for ThinkPad P14s Gen 5 (Type 21G2, 21G3)0 to < 1000.100.108.801—

LenovoElliptic Human Presence Detection Device Driver for ThinkPad P14s Gen 5 (Type 21ME, 21MF)0 to < 1000.100.108.6136—

LenovoElliptic Human Presence detection Device Driver for ThinkPad P16 Gen 2 (Type 21FA, 21FB)0 to < 1000.100.108.774—

LenovoElliptic Virtual Lock Sensor Service for P16s Gen 2 (Type 21HK, 21HL)0 to < 1000.100.108.858—

LenovoElliptic Human Presence Detection Device Driver for ThinkPad P16s Gen 2 (Type 21K9, 21KA)0 to < 1000.100.106.2391—

Lenovolliptic Human Presence Detection Driver for P16s Gen 3 (Type 21KS, 21KT)0 to < 1000.100.108.801—

LenovoElliptic Human Presence Detection Device Driver for ThinkPad P16v Gen 1 (Type 21FC, 21FD)0 to < 1000.100.108.900—

LenovoElliptic Human Presence Detection Driver for ThinkPad P16v Gen 1 (Type 21FE, 21FF)0 to < 1000.100.108.2235—

LenovoElliptic Human Presence Detection Device Driver for ThinkPad P16v Gen 2 (Type 21KX, 21KY)0 to < 1000.100.108.801—

LenovoElliptic Virtual Lock Sensor Service for ThinkPad T14 Gen 3 (Type 21AH, 21AJ)0 to < 3.2.61209.5—

LenovoElliptic Virtual Lock Sensor Service for ThinkPad T14 Gen 3 (Type 21CF, 21CG))0 to < 3.2.61209.5—

LenovoElliptic Virtual Lock Sensor Service for T14 Gen 4 (Type 21HD, 21HE)0 to < 1000.100.108.858—

LenovoElliptic Human Presence Detection Device Driver for T14 Gen 4 (Type 21K3, 21K4)0 to < 1000.100.108.1893—

Lenovolliptic Human Presence Detection Device Driver for T14 Gen 5 (Type 21MC, 21MD)0 to < 1000.100.108.6136—

LenovoElliptic Human Presence Detection Device Driver for T14 Gen 5 (Type 21ML, 21MM)0 to < 1000.100.108.801—

LenovoElliptic Virtual Lock Sensor Service for T14s Gen 4 (Type 21F6, 21F7)0 to < 1000.100.108.858—

LenovoElliptic Human Presence Detection Device Driver for ThinkPad T14s Gen 4 (Type 21F8, 21F9)0 to < 1000.100.108.1893—

LenovoElliptic Human Presence Detection Device Driver for T14s Gen 5 (Type 21LS, 21LT)0 to < 1000.100.108.801—

LenovoElliptic Human Presence Detection driver for ThinkPad T14s Gen 6 (Type 21M1, 21M2)0 to < 1000.100.109.82—

LenovoElliptic Virtual Lock Sensor Service for T16 Gen 2 (Type 21HH, 21HJ)0 to < 1000.100.108.858—

LenovoElliptic Human Presence Detection Device Driver for T16 Gen 2 (Type 21K7 21K8)0 to < 1000.100.106.2391—

LenovoElliptic Human Presence Detection Device Driver for T16 Gen 3 (Type 21MN, 21MQ)0 to < 1000.100.108.801—

LenovoElliptic Virtual Lock Sensor Service for X1 2-in-1 Gen 9 (Type 21KE, 21KF)0 to < 1000.100.108.801—

LenovoElliptic Virtual Lock Sensor Service for ThinkPad X1 Carbon 12th Gen (Type 21KC, 21KD)0 to < 1000.100.108.801—

LenovoElliptic Human Presence Detection Device Driver for X13 2-in-1 Gen 5 (Type 21LW, 21LX)0 to < 1000.100.108.801—

LenovoElliptic Virtual Lock Sensor for ThinkPad X13 Gen 4 (Type 21EX, 21EY)0 to < 1000.100.108.761—

LenovoElliptic Human Presence Detection Driver for ThinkPad X13 Gen 4 (Type 21J3, 21J4)0 to < 1000.100.108.2234—

LenovoElliptic Human Presence Detection Device Driver for X13 Gen 5 (Type 21LU, 21LV)0 to < 1000.100.108.801—

LenovoElliptic Virtual Lock Sensor for X13 Yoga Gen 4 (Type 21F2, 21F3)0 to < 1000.100.108.761—

06 References

support.lenovo.comhttps://support.lenovo.com/us/en/product_security/LEN-182738

07 Remediation

Update to the version (or newer) indicated for your model in the Product Impact section:Â https://support.lenovo.com/us/en/product_security/LEN-182738