CVE-2017-3761 Command injection in Service Framework application
Attackers can execute arbitrary system commands via unsanitized input in the Lenovo Service Framework Android app, leading to remote code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2017-3761?
CVE-2017-3761 is a critical command injection vulnerability in Lenovo Group Ltd. Service Framework application, published on 17 Oct 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Lenovo Service Framework Android application executes some system commands without proper sanitization of external input. In certain cases, this could lead to command injection which, in turn, could lead to remote code execution.
Weakness: CWE-78
Which versions are affected by CVE-2017-3761?
It affects 1 product.
Products include Lenovo Service Framework.
How do I fix CVE-2017-3761?
No fix has been published for CVE-2017-3761 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2017-3761 being exploited?
There is no known exploitation of CVE-2017-3761 in the wild and no public exploit code.
Other vulnerabilities in Lenovo Group Ltd. Service Framework application
Sources
Also known as GHSA-48q6-j89g-2jvq.