Medium severity · published Aug 10, 2017
CVE-2017-3753
A vulnerability has been identified in some Lenovo products that use UEFI (BIOS) code developed by American Megatrends, Inc
6.8
CVSS
0.5%
EPSS
No
On KEV
Description
A vulnerability has been identified in some Lenovo products that use UEFI (BIOS) code developed by American Megatrends, Inc. (AMI). With this vulnerability, conditions exist where an attacker with administrative privileges or physical access to a system may be able to run specially crafted code that can allow them to bypass system protections such as Device Guard and Hyper-V.
CVSS vector
CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Physical
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 44% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
6F
63 Firmware · Lenovo
fckt78a · source: NVD
HF
H50-30g Firmware · Lenovo
fckt78a · source: NVD
I3
Ideacentre 300-20ish Firmware · Lenovo
All versions, or not specified · source: NVD
I3
Ideacentre 300s-11ish Firmware · Lenovo
All versions, or not specified · source: NVD
I5
Ideacentre 510s-08ish Firmware · Lenovo
All versions, or not specified · source: NVD
I5
Ideacentre 510s-23isu Firmware · Lenovo
o2ekt24a · source: NVD
I7
Ideacentre 700 Firmware · Lenovo
All versions, or not specified · source: NVD
MF
M4500 Firmware · Lenovo
fckt78a · source: NVD
MI
M4500 ID Firmware · Lenovo
fckt78a · source: NVD
MI
M4550 ID Firmware · Lenovo
fckt78a · source: NVD
SF
S200z Firmware · Lenovo
m09kt33a · source: NVD
SF
S500 Firmware · Lenovo
m0kkt24a · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2017-3753
CVE.org
https://www.cve.org/CVERecord?id=CVE-2017-3753
Mitigation
https://support.lenovo.com/us/en/product_security/LEN-14695
More from 63 Firmware
9.8
CVE-2019-6188
The BIOS tamper detection mechanism was not triggered in Lenovo ThinkPad T460p, BIOS versions up to R07ET90W, and T470p, BIOS versions up to R0FET50W, which may allow for…
7.8
CVE-2020-8333
A potential vulnerability in the SMI callback function used in the EEPROM driver in some Lenovo Desktops and ThinkStation models may allow arbitrary code execution
6.4
CVE-2019-6172
A potential vulnerability in the SMI callback function used in Legacy USB driver using passed parameter without sufficient checking in some Lenovo ThinkPad models may allow…
6.4
CVE-2019-6170
A potential vulnerability in the SMI callback function used in the Legacy USB driver using boot services structure in runtime phase in some Lenovo ThinkPad models may allow…