CVE-2019-6165

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

A DLL search path vulnerability was reported in PaperDisplay Hotkey Service version 1.2.0.8 that could allow privilege escalation. Lenovo has ended support for PaperDisplay Hotkey software as the Night light feature introduced in Windows 10 Build 1703 provides similar features.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-426

Affected software

Vendor	Product	Versions
Lenovo	PaperDisplay Hotkey Service	>= unspecified, <= 1.2.0.8

References

https://support.lenovo.com/solutions/LEN-27569Vendor Advisory
https://support.lenovo.com/solutions/LEN-27569Vendor Advisory

Timeline

Published: Aug 19, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-61668.8A vulnerability reported in Lenovo Service Bridge before version 4.1.0.1 could allow cross-site request forgery.CVE-2019-61679.8A vulnerability reported in Lenovo Service Bridge before version 4.1.0.1 could allow remote code execution.CVE-2019-61689.8A vulnerability reported in Lenovo Service Bridge before version 4.1.0.1 could allow remote code execution.CVE-2019-61697.5A vulnerability reported in Lenovo Service Bridge before version 4.1.0.1 could allow unencrypted downloads over FTP.CVE-2019-61706.4A potential vulnerability in the SMI callback function used in the Legacy USB driver using boot services structure in runtime phase in some CVE-2019-61716.8A vulnerability was reported in various BIOS versions of older ThinkPad systems that could allow a user with administrative privileges or ph CVE-2019-61726.4A potential vulnerability in the SMI callback function used in Legacy USB driver using passed parameter without sufficient checking in some CVE-2019-61736.5A DLL search path vulnerability could allow privilege escalation in some Lenovo installation packages, prior to version 1.2.9.3, during inst CVE-2019-61757.5A denial of service vulnerability was reported in Lenovo System Update versions prior to 5.07.0088 that could allow configuration files to b CVE-2019-61767.5A potential vulnerability reported in ThinkPad USB-C Dock Firmware version 3.7.2 may allow a denial of service.CVE-2019-61779.8A vulnerability reported in Lenovo Solution Center version 03.12.003, which is no longer supported, could allow log files to be written to n CVE-2019-61785.3An information leakage vulnerability in Iomega and LenovoEMC NAS products could allow disclosure of some device details such as Share names