A serious vulnerability in Lenovo webcams has been discovered, allowing remote attackers to use these cameras to inject keystrokes and compromise systems undetected. This finding was presented at the DEF CON 2025 conference by researchers from Eclypsium and specifically refers to the 510 FHD and Performance FHD models, which are equipped with SigmaStar processors and run a full Linux operating system.
Beware of Linux and Lenovo!
The root of the problem lies in the lack of signature validation during the firmware update process. Without this validation, attackers can manipulate the device’s flash memory and rewrite the firmware, using specific commands to gain full access to the camera’s internal system. This innovative attack transforms webcams into BadUSB attack tools, capable of emulating human interface devices, such as keyboards, to inject malicious commands.
An alarming feature of this vulnerability is that it allows for the persistence of attacks, meaning that even after a complete reinstallation of the operating system, the compromised webcam can reinfect the system. This methodology represents a significant evolution in cyberattack tactics, as attackers can now exploit connected USB devices without the need for physical replacement.
Lenovo has responded with the creation of an updated firmware installation tool and has released version 4.8.0 for the affected models. Additionally, it has assigned the identifier CVE-2025-4371 to track this vulnerability. However, experts warn that this situation could extend to other USB devices based on Linux, posing a considerable challenge for traditional endpoint security models and highlighting the need to improve trust verification mechanisms in hardware.