CVE-2016-8227

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

Privilege escalation vulnerability in Lenovo Transition application used in Lenovo Yoga, Flex and Miix systems running Windows allows local users to execute code with elevated privileges.

Metrics

CVSS 3.0 7.8/10CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-284

Affected software

Vendor	Product	Versions
Lenovo Group Ltd.	Transition application	all versions

References

http://www.securityfocus.com/bid/95159
https://support.lenovo.com/us/en/product_security/LEN-12508Mitigation, Vendor Advisory
http://www.securityfocus.com/bid/95159
https://support.lenovo.com/us/en/product_security/LEN-12508Mitigation, Vendor Advisory

Timeline

Published: Jan 26, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-82287.8In Lenovo Service Bridge before version 4, a user with local privileges on a system could execute code with administrative privileges.CVE-2016-82298.8A cross-site request forgery vulnerability in Lenovo Service Bridge before version 4 could be exploited by an attacker with access to the DH CVE-2016-82307.5In Lenovo Service Bridge before version 4, an insecure HTTP connection is used by LSB to send system serial number, machine type and model a CVE-2016-82317.5In Lenovo Service Bridge before version 4, a bug found in the signature verification logic of the code signing certificate could be exploite CVE-2016-82326.1Document Object Model-(DOM) based cross-site scripting vulnerability in the Advanced Management Module (AMM) versions earlier than 66Z of Le CVE-2016-82339.8Log files generated by Lenovo XClarity Administrator (LXCA) versions earlier than 1.2.2 may contain user credentials in a non-secure, clear CVE-2016-82357.8Privilege escalation in Lenovo Customer Care Software Development Kit (CCSDK) versions earlier than 2.0.16.3 allows local users to execute c CVE-2016-82367.5Reset to default settings may occur in Lenovo ThinkServer TSM RD350, RD450, RD550, RD650, TD350 during a prolonged broadcast storm in TSM ve CVE-2016-82378.1Remote code execution in Lenovo Updates (not Lenovo System Update) allows man-in-the-middle attackers to execute arbitrary code.CVE-2016-82715.3Huawei eSpace IAD V300R002C01SPC100 and earlier versions have an information leak vulnerability; an attacker can check and download the faul CVE-2016-82725.3Huawei PC client software HiSuite 4.0.5.300_OVE has an information leak vulnerability; an attacker who can log in to the system can copy out CVE-2016-82737.8Huawei PC client software HiSuite 4.0.5.300_OVE uses insecure HTTP for upgrade software package download and does not check the integrity of