The vulnerability enables a local authenticated user to execute arbitrary code with elevated privileges on Lenovo Accessories and Display Manager for Enterprise for Windows. This can lead to full control over the affected machine, potentially allowing the attacker to tamper with system configuration, install additional malware, or exfiltrate data. The weakness is categorized as CWE-306, indicating missing authentication for a critical function.

Lenovo Accessories and Display Manager for Enterprise for Windows. Versions prior to 1.0.9 are vulnerable, as the vendor recommends updating to 1.0.9 or later to remediate the issue.

The CVSS score of 8.5 classifies the flaw as high severity, and the current EPSS score is not available, so the precise likelihood of exploitation is unclear. The vulnerability is not listed in the CISA KEV catalog. The attack vector is local and requires authentication; therefore, the threat is primarily to privileged users on the system. If an attacker gains sufficient local access, they can leverage this flaw to gain full system control.