An input validation vulnerability was discovered in the DeviceSettingsSystemAddin component used by Lenovo Vantage and Lenovo Baiying. The flaw allows a local authenticated user to delete arbitrary registry keys with elevated privileges, which can result in privilege escalation or system disruption as malicious manipulation of registry entries can alter software behavior or cause denial of service. The weakness corresponds to CWE-88 (Incorrect Preservation of Object References).

The vulnerability affects Lenovo Vantage and Lenovo Baiying products that utilize the DeviceSettingsSystemAddin module. Specific version details are not listed, but the known fix applies to all releases prior to DeviceSettingsSystemAddin version 1.0.8.15. Therefore, any deployments running older versions of the add‑in are potentially compromised.

The CVSS base score of 6.9 indicates medium to high severity, while the EPSS score of less than 1% suggests low current likelihood of exploitation. The flaw is limited to locally authenticated users and does not require remote access, and it is not listed in the CISA KEV catalog. Attackers would need local machine access to trigger the deletion of critical registry keys, posing a risk primarily to systems with privileged local users. Nevertheless, the potential for significant impact warrants prompt remediation.