The vulnerability is an authentication bypass in Lenovo Smart Connect for Windows that could allow a local authenticated user to execute arbitrary code with elevated privileges. The defect is identified as CWE-290, an authentication bypass flaw, enabling a user who can log into the Windows system to gain higher privileges and potentially compromise system integrity.

The affected product is Lenovo Smart Connect for Windows. The vendor is Lenovo, and the issue exists in releases prior to 09.0.2.003.000, as the update to that or later versions contains the fix.

The CVSS score is 7.3, indicating a high severity for local privilege escalation. The EPSS score is not available, so the exploitation likelihood cannot be quantified from the publicly available data, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector requires a local authenticated user to run Smart Connect; no remote access vector is described. An attacker with a user session could leverage the authentication bypass to execute code with elevated privileges, resulting in full control over the affected system.