High severity · published Aug 9, 2017
CVE-2017-3752
An industry-wide vulnerability has been identified in the implementation of the Open Shortest Path First (OSPF) routing protocol used on some Lenovo switches
8.2
CVSS
0.4%
EPSS
No
On KEV
Description
An industry-wide vulnerability has been identified in the implementation of the Open Shortest Path First (OSPF) routing protocol used on some Lenovo switches. Exploitation of these implementation flaws may result in attackers being able to erase or alter the routing tables of one or many routers, switches, or other devices that support OSPF within a routing domain.
CVSS vector
CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:H
Attack vector
Adjacent
Complexity
High
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
High
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 38% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LA
Lenovo and IBM Switch Products · Lenovo Group Ltd.
Various · source: vendor
1F
1:10g Firmware · Ibm
through 7.4.16.0 · source: NVD
1L
1g L2-7 Slb · Ibm
through 21.0.24.0 · source: NVD
E1
En2092 1gb Firmware · Ibm
through 7.8.16.0 · source: NVD
FC
Fabric Cn4093 10gb Firmware · Ibm
through 7.8.16.0 · source: NVD
FE
Fabric En4093/en4093r 10gb Firmware · Ibm
through 7.8.16.0 · source: NVD
FE
Fabric En4093r 10gb Firmware · Lenovo
through 8.4.3.0 · source: NVD
GF
G8052 Firmware · Lenovo
through 8.4.3.0 · source: NVD
GF
G8124 Firmware · Ibm
through 7.11.9.0 · source: NVD
GF
G8124e Firmware · Lenovo
through 8.4.3.0 · source: NVD
GF
G8264 Firmware · Lenovo
through 8.4.3.0 · source: NVD
GF
G8264cs Firmware · Lenovo
through 8.4.3.0 · source: NVD
Affected product
LA
Lenovo and IBM Switch Products
Lenovo Group Ltd.