PT-2017-16086 · Lenovo · Lenovo Notebook Systems

Published 2017-07-17 · Updated 2019-10-03 · CVE-2017-3754

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Lenovo notebook systems (affected versions not specified)

Description The issue concerns Lenovo brand notebook systems where write protections are not properly configured in the system BIOS. This could allow an attacker with physical or administrative access to flash the BIOS with an arbitrary image, potentially leading to the execution of malicious BIOS code.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2017-3754

Affected Products

Lenovo Notebook Systems

References · 2

• https://support.lenovo.com/us/en/product_security/LEN-15084 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-3754 · Security Note