CVE-2017-3754

Some Lenovo brand notebook systems do not have write protections properly configured in the system BIOS. This could enable an attacker with physical or administrative access to a system to be able to flash the BIOS with an arbitrary image and potentially run malicious BIOS code.

CVSS v3 6.7 MEDIUM
CVSS v2.0 7.2 HIGH

6.7^/10

CVSS v3 : MEDIUM

V3 Legend

Vector : AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Exploitability : 0.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

7.2^/10

CVSS v2.0 : HIGH

V2 Legend

Vector : AV:L/AC:L/Au:N/C:C/I:C/A:C

Exploitability : 3.9 / Impact : 10.0

Access Vector LOCAL

Access Complexity LOW

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
https://support.lenovo.com/us/en/product_security/LEN-15084	Vendor Advisory
https://support.lenovo.com/us/en/product_security/LEN-15084	Vendor Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:lenovo:bios:-:*:*:*:*:*:*:*

OR	cpe:2.3:h:lenovo:710s-13ikb\/xiaoxin_air_13ikb:-:::::::*
	cpe:2.3:h:lenovo:710s-13isk\/xiaoxin_air_13:-:::::::*
	cpe:2.3:h:lenovo:k21-80:-:::::::*
	cpe:2.3:h:lenovo:k22-80\/lenovo_v720-12:-:::::::*
	cpe:2.3:h:lenovo:k41-80:-:::::::*
	cpe:2.3:h:lenovo:lenovo_ideapad_110-14ast:-:::::::*
	cpe:2.3:h:lenovo:lenovo_ideapad_110-15ast:-:::::::*
	cpe:2.3:h:lenovo:lenovo_ideapad_320-14ast:-:::::::*
	cpe:2.3:h:lenovo:lenovo_ideapad_320-15ast:-:::::::*
	cpe:2.3:h:lenovo:lenovo_xiaoxin_rui7000:-:::::::*
	cpe:2.3:h:lenovo:miix_710-12ikb:-:::::::*
	cpe:2.3:h:lenovo:miix_720-12ikb:-:::::::*
	cpe:2.3:h:lenovo:notebook_320-17ast:-:::::::*
	cpe:2.3:h:lenovo:rescuer_e520-15ikb:-:::::::*
	cpe:2.3:h:lenovo:v110-14iap:-:::::::*
	cpe:2.3:h:lenovo:v110-15iap:-:::::::*
	cpe:2.3:h:lenovo:v110-15ikb:-:::::::*
	cpe:2.3:h:lenovo:v110-15isk:-:::::::*
	cpe:2.3:h:lenovo:yoga_710-11ikb:-:::::::*

History

21 Nov 2024, 03:26

Type	Values Removed	Values Added
References	~~() https://support.lenovo.com/us/en/product_security/LEN-15084 - Vendor Advisory~~	() https://support.lenovo.com/us/en/product_security/LEN-15084 - Vendor Advisory

Information

Published : 2017-07-17 19:29

Updated : 2025-04-20 01:37

NVD link : CVE-2017-3754

Mitre link : CVE-2017-3754

CVE.ORG link : CVE-2017-3754

JSON object : View

Products Affected

lenovo

miix_710-12ikb
v110-15isk
yoga_710-11ikb
lenovo_ideapad_320-14ast
v110-15iap
v110-14iap
v110-15ikb
lenovo_ideapad_320-15ast
bios
lenovo_xiaoxin_rui7000
miix_720-12ikb
rescuer_e520-15ikb
710s-13ikb\/xiaoxin_air_13ikb
lenovo_ideapad_110-14ast
k41-80
710s-13isk\/xiaoxin_air_13
notebook_320-17ast
k22-80\/lenovo_v720-12
k21-80
lenovo_ideapad_110-15ast

CWE

NVD-CWE-noinfo

{"id": "CVE-2017-3754", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.2, "accessVector": "LOCAL", "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 3.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 6.7, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 0.8}]}, "published": "2017-07-17T19:29:00.323", "references": [{"url": "https://support.lenovo.com/us/en/product_security/LEN-15084", "tags": ["Vendor Advisory"], "source": "psirt@lenovo.com"}, {"url": "https://support.lenovo.com/us/en/product_security/LEN-15084", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "Some Lenovo brand notebook systems do not have write protections properly configured in the system BIOS. This could enable an attacker with physical or administrative access to a system to be able to flash the BIOS with an arbitrary image and potentially run malicious BIOS code."}, {"lang": "es", "value": "Algunos sistemas notebook de la marca Lenovo no tienen protecciones de escritura configuradas apropiadamente en el BIOS del sistema. Esto podr\u00eda permitir a un atacante con acceso f\u00edsico o administrativo a un sistema para ser capaz de flashear el BIOS con una imagen arbitraria y potencialmente ejecutar c\u00f3digo BIOS malicioso."}], "lastModified": "2025-04-20T01:37:25.860", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:lenovo:bios:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "61D66F0D-6C60-4CF6-A509-C6FAC2E22F95"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:lenovo:710s-13ikb\\/xiaoxin_air_13ikb:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "CF203824-4977-4970-93FA-311FC0726DE8"}, {"criteria": "cpe:2.3:h:lenovo:710s-13isk\\/xiaoxin_air_13:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "FA559DCA-5395-4205-916B-62A94E078788"}, {"criteria": "cpe:2.3:h:lenovo:k21-80:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "E56C7CE7-D4A0-4179-B65D-EA8EDA2F7299"}, {"criteria": "cpe:2.3:h:lenovo:k22-80\\/lenovo_v720-12:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "6817BA2D-2383-428F-941D-BCAC7A476818"}, {"criteria": "cpe:2.3:h:lenovo:k41-80:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "BDC9595C-D1DA-4769-9401-1D2430CE69CE"}, {"criteria": "cpe:2.3:h:lenovo:lenovo_ideapad_110-14ast:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "E63C6054-D0EE-4AED-B829-A2F676E89D86"}, {"criteria": "cpe:2.3:h:lenovo:lenovo_ideapad_110-15ast:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "3E3F252A-E00B-40AA-8F02-7987D2102D4D"}, {"criteria": "cpe:2.3:h:lenovo:lenovo_ideapad_320-14ast:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "0BD8431A-FFF2-4519-BCC3-80A8B76CC80E"}, {"criteria": "cpe:2.3:h:lenovo:lenovo_ideapad_320-15ast:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "21481398-B4A5-4C7F-BA4F-A52D6C13756B"}, {"criteria": "cpe:2.3:h:lenovo:lenovo_xiaoxin_rui7000:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "94BA3B3C-0E21-4877-8B0D-11E5FEF12384"}, {"criteria": "cpe:2.3:h:lenovo:miix_710-12ikb:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "9BE26E1F-D6B8-4ECD-86DE-D492BBC1FE64"}, {"criteria": "cpe:2.3:h:lenovo:miix_720-12ikb:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "D0E7697B-53B4-4A2A-B285-0620962A0E4A"}, {"criteria": "cpe:2.3:h:lenovo:notebook_320-17ast:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "719BD6FE-DB95-4096-9829-33536AD077C8"}, {"criteria": "cpe:2.3:h:lenovo:rescuer_e520-15ikb:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "9CC1D30D-C105-4BAF-9085-7E5C8D253A23"}, {"criteria": "cpe:2.3:h:lenovo:v110-14iap:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "FAED167E-15AF-4B45-952C-113726BCFAE0"}, {"criteria": "cpe:2.3:h:lenovo:v110-15iap:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "972B1468-D71C-449C-B392-4A62BA9BF835"}, {"criteria": "cpe:2.3:h:lenovo:v110-15ikb:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "9423385C-5562-4578-9602-C85ED87CB530"}, {"criteria": "cpe:2.3:h:lenovo:v110-15isk:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "B7C41B17-C208-4A3A-BCC5-F7D4046A9249"}, {"criteria": "cpe:2.3:h:lenovo:yoga_710-11ikb:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "A573B96D-E21C-4869-A6CE-FDB3926875CB"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "psirt@lenovo.com"}

6.7 /10