Lenovo joins many others in not being prepared to secure the trust thats established by keys and certificates. Failing to validate a certificate properly gives bad guys the powerful weapons they need to circumvent security controls. With a compromised or forged certificate, you can masquerade as a trusted service, hide in encryption, and go undetected. With little to no visibility into how the tens of thousands of keys and. certificates in the average enterprise are used, no. ability to enforce policy, and no ability to detect or respond to anomalies and increased threats.”]
Source: https://informationsecuritybuzz.com/articles/new-flaws-identified-in-lenovos-system-update-service/