CVE-2023-3112

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

A vulnerability was reported in Elliptic Labs Virtual Lock Sensor for ThinkPad T14 Gen 3 that could allow an attacker with local access to execute code with elevated privileges.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-276

Affected software

Vendor	Product	Versions
Lenovo	Elliptic Labs Virtual Lock Sensor	All versions prior to 3.1.50719.1
Lenovo	AI Virtual Presence Sensor	All versions prior to 3.1.50719.1
lenovo	thinkpad_t14_gen_3	<= 3.1.50719.1

References

https://support.lenovo.com/us/en/product_security/LEN-128081Vendor Advisory
https://support.lenovo.com/us/en/product_security/LEN-128081Vendor Advisory

Timeline

Published: Oct 25, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-311227.5Out-of-bounds Read vulnerability in mod_macro of Apache HTTP Server.This issue affects Apache HTTP Server: through 2.4.57.CVE-2023-311239.1`effectindex/tripreporter` is a community-powered, universal platform for submitting and analyzing trip reports. Prior to commit bd80ba833b9 CVE-2023-311243.7c-ares is an asynchronous resolver library. When cross-compiling c-ares and using the autotools build system, CARES_RANDOM_FILE will not be CVE-2023-311256.5Engine.IO is the implementation of transport-based cross-browser/cross-device bi-directional communication layer for Socket.IO. An uncaught CVE-2023-311269.6`org.xwiki.commons:xwiki-commons-xml` is an XML library used by the open-source wiki platform XWiki. The HTML sanitizer, introduced in versi CVE-2023-311278.8libspdm is a sample implementation that follows the DMTF SPDM specifications. A vulnerability has been identified in SPDM session establishm CVE-2023-311288.8NextCloud Cookbook is a recipe library app. Prior to commit a46d9855 on the `master` branch and commit 489bb744 on the `main-0.9.x` branch, CVE-2023-311299.8The Contiki-NG operating system versions 4.8 and prior can be triggered to dereference a NULL pointer in the message handling code for IPv6 CVE-2023-31137.5An unauthenticated XML external entity injection (XXE) vulnerability exists in LXCA's Common Information Model (CIM) server that could resul CVE-2023-311306.4c-ares is an asynchronous resolver library. ares_inet_net_pton() is vulnerable to a buffer underflow for certain ipv6 addresses, in particul CVE-2023-311319.1Greenplum Database (GPDB) is an open source data warehouse based on PostgreSQL. In versions prior to 6.22.3 Greenplum Database used an unsaf CVE-2023-311327.8Cacti is an open source operational monitoring and fault management framework. Affected versions are subject to a privilege escalation vulne