{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/baiying-pc-client/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:lenovo:baiying_pc_client:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.3,"id":"CVE-2026-92629"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Baiying PC Client"],"_cs_severities":["high"],"_cs_tags":["privilege-escalation","windows","local-exploitation"],"_cs_type":"advisory","_cs_vendors":["Lenovo"],"content_html":"\u003cp\u003eA vulnerability identified as CVE-2026-92629 exists in the Lenovo Baiying PC Client, a software package distributed specifically within the Chinese market. The vulnerability is classified as an improper authorization flaw. It allows a local, authenticated user to interact with the application in a manner that bypasses existing access controls, leading to the execution of arbitrary code with elevated system privileges. This escalation of privilege significantly impacts the security posture of the host machine, as the attacker can perform operations reserved for administrative accounts. Given the local nature of the attack, this vulnerability is particularly relevant in multi-user environments or scenarios where non-privileged users have access to corporate workstations where this client is installed.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows a local user to execute arbitrary code with elevated privileges, potentially leading to full system compromise. This represents a high risk in enterprise environments where users are not restricted from executing local applications or where shared workstations are deployed. The scope of impact is limited to the subset of Lenovo devices in the Chinese market running the vulnerable client software.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003eIdentify all endpoints running Lenovo Baiying PC Client within your environment and restrict local user access to the binary until an official vendor patch is applied.\u003c/p\u003e\n","date_modified":"2026-10-16T00:41:28Z","date_published":"2026-10-16T00:41:28Z","id":"https://feed.craftedsignal.io/briefs/2026-10-lenovo-baiying-privilege-escalation/","summary":"A local improper authorization vulnerability in Lenovo Baiying PC Client allows an authenticated user to achieve privilege escalation through arbitrary code execution.","title":"Improper Authorization in Lenovo Baiying PC Client","url":"https://feed.craftedsignal.io/briefs/2026-10-lenovo-baiying-privilege-escalation/"}],"language":"en","title":"CraftedSignal Threat Feed - Baiying PC Client","version":"https://jsonfeed.org/version/1.1"}