CVE-2025-4424

MediumCVSS 6.0/10Last modified Jun 17, 2026

Description

The vulnerability was identified in the code developed specifically for Lenovo. Please visit "Lenovo Product Security Advisories and Announcements" webpage for more information about the vulnerability. https://support.lenovo.com/us/en/product_security/home

Metrics

CVSS 3.1 6.0/10CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:N

Weakness enumeration

CWE-20

Affected software

Vendor	Product	Versions
Insyde Software	InsydeH2O	>= Feature developed for Lenovo, < L05.05.40.011803.172079

References

Timeline

Published: Jul 30, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-44258.2The vulnerability was identified in the code developed specifically for Lenovo. Please visit "Lenovo Product Security Advisories and Announc CVE-2025-442517.5Ecovacs Deebot T10 1.7.2 transmits Wi-Fi credentials in cleartext during the pairing process.CVE-2025-44266.0The vulnerability was identified in the code developed specifically for Lenovo. Please visit "Lenovo Product Security Advisories and Announc CVE-2025-44277.5An authentication bypass in the API component of Ivanti Endpoint Manager Mobile 12.5.0.0 and prior allows attackers to access protected reso CVE-2025-44288.8Remote Code Execution in API component in Ivanti Endpoint Manager Mobile 12.5.0.0 and prior on unspecified platforms allows authenticated at CVE-2025-44296.1The Gearside Developer Dashboard WordPress plugin through 1.0.72 does not sanitise and escape a parameter before outputting it back in the p CVE-2025-44308.6Unauthorized access to "/api/Token/gettoken" endpoint in EZD RP allows file manipulation.This issue affects EZD RP in versions before 20.19 CVE-2025-44314.3The Featured Image Plus – Quick & Bulk Edit with Unsplash plugin for WordPress is vulnerable to unauthorized modification of data due to a m CVE-2025-44325.3A flaw was found in Rust's Ring package. A panic may be triggered when overflow checking is enabled. In the QUIC protocol, this flaw allows CVE-2025-44338.8Improper access control in user group management in Devolutions Server 2025.1.7.0 and earlier allows a non-administrative user with both "Us CVE-2025-44357.5When using a TarFile.errorlevel = 0 and extracting with a filter the documented behavior is that any filtered members would be skipped and n CVE-2025-44375.7There's a vulnerability in the CRI-O application where when container is launched with securityContext.runAsUser specifying a non-existent u