Find notable cyber news and cases, enriched with sources, timelines, and signals.
Home Browse News Feed Stats Watchlists Beta About Contact

Lenovo 510 FHD and Lenovo Performance FHD webcam firmware validation flaw (CVE-2025-4371)

Vulnerability
First reported
Last updated
Happening score
H score 11
1 unique sources, 1 articles

Summary

Hide ▲

Lenovo 510 FHD and Lenovo Performance FHD webcams were found to skip firmware validation, exposing CVE-2025-4371 and letting attackers turn attached devices into BadUSB-style implants. The flaw can let an attacker inject keystrokes, deliver payloads, and maintain cross-host persistence while the webcam still appears to function normally. Lenovo released firmware updates 4.8.0 to mitigate the issue after disclosure ahead of DEF CON 33.

Timeline

  1. 09.08.2025 22:00 1 articles · 9mo ago

    Eclypsium discloses BadCam in Lenovo webcams

    Initial Disclosure

    Eclypsium disclosed BadCam (CVE-2025-4371) affecting Lenovo 510 FHD and Lenovo Performance FHD webcams, showing that a firmware validation flaw in Linux-powered USB Gadget webcams could let an attacker with remote code execution or physical access reflash the camera firmware, turn the device into a BadUSB implant, inject keystrokes, deliver payloads, and maintain persistence across hosts.

    Show sources
    Open in new tab