Yes—specific Lenovo preloads have caused documented security problems, but that does not mean every pre-installed Lenovo app or current Lenovo PC is unsafe. The best-known case is Superfish VisualDiscovery on some U.S. consumer laptops in 2014–2015; a separate Lenovo advisory describes a privilege-escalation vulnerability in Vantage for specified device families. The right response depends on the exact app, model, and advisory.
What happened with Superfish VisualDiscovery?
The Federal Trade Commission (FTC) reported that Lenovo began selling some consumer laptops in the United States with Superfish’s VisualDiscovery software in August 2014. The program injected shopping advertisements and sat between the browser and websites, including sites using HTTPS encryption.
According to the FTC, VisualDiscovery replaced website certificates with certificates it signed itself without adequately verifying the original certificates. The same easy-to-crack password was used on affected laptops. The FTC said this could suppress browser security warnings and expose sensitive communications to potential interception. Those findings concern VisualDiscovery; they do not establish that unrelated Lenovo applications work the same way.
The FTC described the software as installed on “hundreds of thousands” of laptops, without giving an exact total. In its September 5, 2017 release, FTC Acting Chairman Maureen K. Ohlhausen said: “Lenovo compromised consumers’ privacy when it preloaded software that could access consumers’ sensitive information without adequate notice or consent to its use.” This statement refers to the VisualDiscovery case, not all Lenovo preloads.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →#1 Best Overall
How Lenovo responded—and what that response does not prove
In a February 20, 2015 statement, Lenovo said it had stopped preloading Superfish, shut down its server connections in January, and released a removal tool, with Microsoft and McAfee also taking action. Lenovo said the issue did not affect ThinkPads, tablets, desktops, smartphones, or enterprise server and storage products. Those are Lenovo’s statements about that incident at that time, not a guarantee about the security of products today.
In a February 23, 2015 open letter, Lenovo CTO Peter Hortensius described Superfish as software that “frustrated some users without adding value to the experience.” That characterization, too, is specific to the company’s response at the time.
Rank #2
A separate Lenovo Vantage vulnerability
Lenovo advisory LEN-183176 covers CVE-2024-12673, a local privilege-escalation vulnerability in a BIOS-customization feature of Lenovo Vantage. Lenovo lists the following device families as affected when Vantage is installed:
- Lenovo V Series Gen 5
- ThinkBook 14 Gen 6 and Gen 7
- ThinkBook 16 Gen 6 and Gen 7
- ThinkPad E Series Gen 1
Lenovo recommends updating Vantage to version 10.2501.15.0 or newer for the affected scope described in the LEN-183176 advisory. This is distinct from the Superfish incident: it concerns a specific feature, vulnerability, and set of device families, not Lenovo software generally.
How to check a Lenovo PC safely
- Identify the device and app. Note the exact Lenovo model, installed application name, and application version. Do not assume that an app is vulnerable simply because it came pre-installed.
- Check Lenovo’s security advisories. Search the Lenovo Product Security Advisories and Announcements for the model and application. Compare the affected-product list and required version in the advisory; these details are specific to each notice.
- Apply the matching fix. If the advisory covers your device and installed version, follow Lenovo’s update instructions. For the Vantage issue described above, Lenovo’s recommendation is version 10.2501.15.0 or newer.
- Remove unwanted software through normal controls. If an app is merely unwanted and no security advisory applies, use Windows app-management settings or the software vendor’s removal instructions. Unwanted software and a confirmed security vulnerability are not the same thing.
- Treat old Superfish instructions as historical. Lenovo’s 2015 response and removal information relate to that past incident. For a device that may still have VisualDiscovery, use Lenovo’s current support resources rather than relying on an old removal link or tool.
How the two cases differ
| Concern | Scope and software | Issue and potential impact | Status and vendor guidance |
|---|---|---|---|
| Superfish VisualDiscovery | Some U.S. consumer laptops sold beginning in August 2014 with Superfish VisualDiscovery, according to the FTC. | Intercepted browser connections and substituted certificates without adequate verification; the FTC said this could suppress warnings and expose sensitive communications to potential interception. | Historical incident. Lenovo said in February 2015 that it stopped preloads, shut down server connections, and released a removal tool; consult current Lenovo support resources for present-day device guidance. |
| CVE-2024-12673 in Lenovo Vantage | Lenovo V Series Gen 5, ThinkBook 14 and 16 Gen 6 and 7, and ThinkPad E Series Gen 1, when Vantage is installed, per advisory LEN-183176. | Local privilege escalation in a BIOS-customization feature of Vantage. | Lenovo recommends Vantage 10.2501.15.0 or newer for the affected scope in its advisory. |
What these incidents mean for Lenovo owners
There is credible evidence that particular Lenovo preloads created security risks, but these examples do not establish a current prevalence rate for vulnerable Lenovo pre-installed software. A useful assessment starts with the device model and app version, then checks the relevant Lenovo advisory. Keep security findings separate from complaints that an app is unnecessary or intrusive: each calls for a different response.
