{"id":"CVE-2025-4371","state":"PUBLISHED","title":"A potential vulnerability was reported in the Lenovo 510 FHD and Performance FHD web cameras that could allow an attacker with physical access to write arbitrary firmware updates t","description":"A potential vulnerability was reported in the Lenovo 510 FHD and Performance FHD web cameras that could allow an attacker with physical access to write arbitrary firmware updates to the device over a USB connection.","publishedAt":"2025-08-18T20:04:19.300Z","updatedAt":"2025-08-19T13:01:02.706Z","severity":{"score":7,"label":"High","version":"4.0","vector":"CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","source":"lenovo"},"assigner":"lenovo","products":["Lenovo 510 FHD Webcam","Lenovo Performance FHD Webcam"],"affected":[{"vendor":"Lenovo","product":"510 FHD Webcam","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"4.8.0","versionType":"custom"}]},{"vendor":"Lenovo","product":"Performance FHD Webcam","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"4.8.0","versionType":"custom"}]}],"references":["https://support.lenovo.com/us/en/product_security/LEN-194466"],"weaknesses":["CWE-347"],"ingestedAt":"2026-10-29T20:09:23.771Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/4xxx/CVE-2025-4371.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2025-4371","state":"PUBLISHED","datePublished":"2025-08-18T20:04:19.300Z","dateUpdated":"2025-08-19T13:01:02.706Z","assignerShortName":"lenovo","assignerOrgId":"da227ddf-6e25-4b41-b023-0f976dcaca4b","dateReserved":"2025-05-05T19:55:25.838Z"},"containers":{"cna":{"descriptions":[{"lang":"en","value":"A potential vulnerability was reported in the Lenovo 510 FHD and Performance FHD web cameras that could allow an attacker with physical access to write arbitrary firmware updates to the device over a USB connection."}],"affected":[{"vendor":"Lenovo","product":"510 FHD Webcam","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"4.8.0","versionType":"custom"}]},{"vendor":"Lenovo","product":"Performance FHD Webcam","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"4.8.0","versionType":"custom"}]}],"references":[{"url":"https://support.lenovo.com/us/en/product_security/LEN-194466"}],"metrics":[{"cvssV4_0":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"PHYSICAL","baseScore":7,"baseSeverity":"HIGH","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]},{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"PHYSICAL","availabilityImpact":"HIGH","baseScore":6.8,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-347","description":"CWE-347: Improper Verification of Cryptographic Signature","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"lenovo","orgId":"da227ddf-6e25-4b41-b023-0f976dcaca4b","dateUpdated":"2025-08-18T20:04:19.300Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:h:lenovo:510_fhd_webcam:*:*:*:*:*:*:*:*","versionEndExcluding":"4.8.0"},{"vulnerable":true,"criteria":"cpe:2.3:h:lenovo:performance_fhd_webcam:*:*:*:*:*:*:*:*","versionEndExcluding":"4.8.0"}]}]}],"credits":[{"lang":"en","type":"finder","value":"Lenovo thanks Mickey Shkatov and Jesse Michael of Eclypsium for reporting this issue."}],"solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"<span style=\"background-color: rgb(255, 255, 255);\">Update your web camera by downloading and running versio</span>n 4.8.0<span style=\"background-color: rgb(255, 255, 255);\">&nbsp;of the firmware update tool:</span><br><a target=\"_blank\" rel=\"nofollow\" href=\"https://support.lenovo.com/us/en/accessories/acc500235-lenovo-510-fhd-webcam-overview-and-service-parts\">https://support.lenovo.com/us/en/accessories/acc500235-lenovo-510-fhd-webcam-overview-and-service-parts</a>\n\n<br>"}],"value":"Update your web camera by downloading and running version 4.8.0 of the firmware update tool:\n https://support.lenovo.com/us/en/accessories/acc500235-lenovo-510-fhd-webcam-overview-and-service-parts"}],"source":{"discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 0.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-08-19T13:00:54.117524Z","id":"CVE-2025-4371","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-08-19T13:01:02.706Z"}}]}}}