CVE-2017-3754 Security feature bypass in Lenovo Notebook BIOS
Attackers with physical or admin access can flash malicious BIOS code due to missing write protections in Lenovo notebooks.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2017-3754?
CVE-2017-3754 is a medium-severity vulnerability in Lenovo Notebook BIOS, published on 17 Jul 2017. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Some Lenovo brand notebook systems do not have write protections properly configured in the system BIOS. This could enable an attacker with physical or administrative access to a system to be able to flash the BIOS with an arbitrary image and potentially run malicious BIOS code.
Which versions are affected by CVE-2017-3754?
It affects 1 product.
Products include Lenovo Bios.
How do I fix CVE-2017-3754?
No fix has been published for CVE-2017-3754 yet. Limit exposure of the affected software until one is available.
Is CVE-2017-3754 being exploited?
There is no known exploitation of CVE-2017-3754 in the wild and no public exploit code.
Other vulnerabilities in Lenovo Notebook BIOS
- CVE-2016-5247 Security feature bypass in n/a
- CVE-2021-3452 Code injection in ThinkPad BIOS
- CVE-2016-8224 Privilege escalation in Lenovo Notebook models 110-14IBR/110-15IBR, B70-80, E31-80, E40-80, E41-80, E51-80, G40-80, G50-80, G50-80 Touch, Ideapad 300-14IBR/300-15IBR, Ideapad 300-14ISK/300-15ISK/300-17ISK, Ideapad 510S-12ISK, K21-80, K41-80, MIIX 710-12IKB , XiaoXin Air 12, YOGA 510-14ISK/510-15ISK, YOGA 710-11IKB, Yoga 710-11ISK, Yoga 900-13ISK, YOGA 900S-12ISK; ThinkServer models ThinkServer TS150, ThinkServer TS450
Sources
Also known as GHSA-xwm6-w9x3-p4hx.