PT-2017-16091 · Lenovo · Lenovo Service Framework

Published 2017-10-17 · Updated 2019-10-03 · CVE-2017-3760

Positive Technologies (AI Summary)

CVSS v2.0

5.1

Medium

Base vector

AV:N/AC:H/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Lenovo Service Framework (affected versions not specified)

Description The Lenovo Service Framework Android application is exposed to man-in-the-middle attacks due to its use of nonsecure credentials for integrity verification of downloaded applications and/or data. This could potentially lead to remote code execution.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Insufficiently Protected Credentials

Weakness Enumeration

CWE-522

CWE-354

Related Identifiers

CVE-2017-3760

Affected Products

Lenovo Service Framework

References · 2

• https://nvd.nist.gov/vuln/detail/CVE-2017-3760 · Security Note
• https://support.lenovo.com/us/en/product_security/LEN-15374 · Vendor Advisory