Details of VAR-201708-0554

ID

VAR-201708-0554

CVE

CVE-2017-3753

TITLE

AMI Developed by UEFI Some use code Lenovo Code injection vulnerability in products

Trust: 0.8

sources: JVNDB: JVNDB-2017-007403

DESCRIPTION

A vulnerability has been identified in some Lenovo products that use UEFI (BIOS) code developed by American Megatrends, Inc. (AMI). With this vulnerability, conditions exist where an attacker with administrative privileges or physical access to a system may be able to run specially crafted code that can allow them to bypass system protections such as Device Guard and Hyper-V. American Megatrends, Inc. LenovoIdeaCentre300-20ISH and so on are all products of China Lenovo. The LenovoIdeaCentre300-20ISH is a desktop computer; the ThinkServerRD540 is a server device. BIOSSMIHandler is one of the management information structure handlers. A security vulnerability exists in BIOSSMIHandler in several Lenovo products due to a program failing to perform input validation. A local attacker can exploit this issue to execute arbitrary code in the context of the user running the affected application. Lenovo IdeaCentre 300-20ISH, etc. There is a security vulnerability in the BIOS SMI Handler in several Lenovo products. The following versions are affected: Lenovo IdeaCentre 300-20ISH; Lenovo M4550 ID; ThinkCentre E73s; ThinkCentre M4500k; ThinkServer RD540; ThinkServer TS140; Thinkstation P510; Thinkstation P910, etc

Trust: 2.52

sources: NVD: CVE-2017-3753 // JVNDB: JVNDB-2017-007403 // CNVD: CNVD-2017-28413 // BID: 100488 // VULHUB: VHN-111956

IOT TAXONOMY

category:

['Network device']

sub_category:

Trust: 0.6

sources: CNVD: CNVD-2017-28413

AFFECTED PRODUCTS

vendor:	lenovo	model:	thinkstation d30 \	scope:	eq	version:	a3kt57a	Trust: 2.0
vendor:	lenovo	model:	thinkstation c30 \	scope:	eq	version:	a1kt57a	Trust: 2.0
vendor:	lenovo	model:	thinkstation s30 \	scope:	eq	version:	a2kt54a	Trust: 2.0
vendor:	lenovo	model:	thinkstation c30	scope:	-	version:	-	Trust: 1.6
vendor:	lenovo	model:	thinkstation d30	scope:	-	version:	-	Trust: 1.6
vendor:	lenovo	model:	thinkstation s30	scope:	-	version:	-	Trust: 1.6
vendor:	lenovo	model:	ideacentre 300s-11ish	scope:	eq	version:	-	Trust: 1.6
vendor:	lenovo	model:	ideacentre 700	scope:	eq	version:	-	Trust: 1.6
vendor:	lenovo	model:	s500	scope:	eq	version:	m0kkt24a	Trust: 1.6
vendor:	lenovo	model:	ideacentre 510s-08ish	scope:	eq	version:	-	Trust: 1.6
vendor:	lenovo	model:	63	scope:	eq	version:	fckt78a	Trust: 1.6
vendor:	lenovo	model:	m4500	scope:	eq	version:	fckt78a	Trust: 1.6
vendor:	lenovo	model:	m4550 id	scope:	eq	version:	fckt78a	Trust: 1.6
vendor:	lenovo	model:	ideacentre 300-20ish	scope:	eq	version:	-	Trust: 1.6
vendor:	lenovo	model:	m4500 id	scope:	eq	version:	fckt78a	Trust: 1.6
vendor:	lenovo	model:	h50-30g	scope:	eq	version:	fckt78a	Trust: 1.6
vendor:	lenovo	model:	ideacentre 300-20ish	scope:	-	version:	-	Trust: 1.4
vendor:	lenovo	model:	thinkcentre e73s	scope:	-	version:	-	Trust: 1.4
vendor:	lenovo	model:	thinkcentre m4500k	scope:	-	version:	-	Trust: 1.4
vendor:	lenovo	model:	thinkserver rd540	scope:	-	version:	-	Trust: 1.4
vendor:	lenovo	model:	thinkserver ts140	scope:	-	version:	-	Trust: 1.4
vendor:	lenovo	model:	thinkstation p510	scope:	-	version:	-	Trust: 1.4
vendor:	lenovo	model:	thinkstation p910	scope:	-	version:	-	Trust: 1.4
vendor:	lenovo	model:	thinkserver ts550	scope:	eq	version:	-	Trust: 1.0
vendor:	lenovo	model:	thinkcentre m710t\/s	scope:	eq	version:	-	Trust: 1.0
vendor:	lenovo	model:	thinkcentre e93	scope:	eq	version:	fbktc5a	Trust: 1.0
vendor:	lenovo	model:	thinkcentre m73z \	scope:	eq	version:	fgkt46a	Trust: 1.0
vendor:	lenovo	model:	thinkserver rd640	scope:	eq	version:	a1tsb5a	Trust: 1.0
vendor:	lenovo	model:	thinkcentre m83	scope:	eq	version:	fbktcga	Trust: 1.0
vendor:	lenovo	model:	thinkcentre m79	scope:	eq	version:	m0lkt12a	Trust: 1.0
vendor:	lenovo	model:	thinkstation p910	scope:	eq	version:	-	Trust: 1.0
vendor:	lenovo	model:	thinkserver td340	scope:	eq	version:	a3tsb5a	Trust: 1.0
vendor:	lenovo	model:	thinkstation p710	scope:	eq	version:	-	Trust: 1.0
vendor:	lenovo	model:	thinkcentre m93	scope:	eq	version:	fbktc5a	Trust: 1.0
vendor:	lenovo	model:	thinkcentre m910x	scope:	eq	version:	-	Trust: 1.0
vendor:	lenovo	model:	thinkcentre m6600	scope:	eq	version:	fwkt39a	Trust: 1.0
vendor:	lenovo	model:	yangtian afh81	scope:	eq	version:	fckt80a	Trust: 1.0
vendor:	lenovo	model:	thinkcentre e74	scope:	eq	version:	m05kt54a	Trust: 1.0
vendor:	lenovo	model:	yangtian mc h110	scope:	eq	version:	m05kt61a	Trust: 1.0
vendor:	lenovo	model:	yangtian afq150	scope:	eq	version:	fwkt57a	Trust: 1.0
vendor:	lenovo	model:	thinkcentre m700z	scope:	eq	version:	fvkt48a	Trust: 1.0
vendor:	lenovo	model:	thinkcentre m8250z	scope:	eq	version:	fgkt46a	Trust: 1.0
vendor:	lenovo	model:	thinkcentre m610	scope:	eq	version:	-	Trust: 1.0
vendor:	lenovo	model:	yangtian mc h81	scope:	eq	version:	fckt80a	Trust: 1.0
vendor:	lenovo	model:	thinkserver rd440	scope:	eq	version:	a0tsb5a	Trust: 1.0
vendor:	lenovo	model:	thinkcentre e73	scope:	eq	version:	fckt78a	Trust: 1.0
vendor:	lenovo	model:	thinkcentre m8350z	scope:	eq	version:	fvkt42a	Trust: 1.0
vendor:	lenovo	model:	ideacentre 510s-23isu	scope:	eq	version:	o2ekt24a	Trust: 1.0
vendor:	lenovo	model:	thinkserver rd340	scope:	eq	version:	-	Trust: 1.0
vendor:	lenovo	model:	yangtian mc carrizo-l	scope:	eq	version:	-	Trust: 1.0
vendor:	lenovo	model:	thinkcentre m4500k	scope:	eq	version:	fckt78a	Trust: 1.0
vendor:	lenovo	model:	thinkcentre m9500z	scope:	eq	version:	fukt44a	Trust: 1.0
vendor:	lenovo	model:	thinkcentre m7300z	scope:	eq	version:	fvkt42a	Trust: 1.0
vendor:	lenovo	model:	v320-15iap	scope:	eq	version:	-	Trust: 1.0
vendor:	lenovo	model:	thinkcentre m92	scope:	eq	version:	9skt95a	Trust: 1.0
vendor:	lenovo	model:	thinkcentre m72e	scope:	eq	version:	f1kt71a	Trust: 1.0
vendor:	lenovo	model:	thinkstation p500	scope:	eq	version:	a4kt86a	Trust: 1.0
vendor:	lenovo	model:	thinkcentre m910q	scope:	eq	version:	-	Trust: 1.0
vendor:	lenovo	model:	thinkstation p310	scope:	eq	version:	fwkt57a	Trust: 1.0
vendor:	lenovo	model:	thinkcentre e74s	scope:	eq	version:	m05kt54a	Trust: 1.0
vendor:	lenovo	model:	yangtian s800	scope:	eq	version:	ffkt43a	Trust: 1.0
vendor:	lenovo	model:	thinkcentre m4500q	scope:	eq	version:	fhkt66a	Trust: 1.0
vendor:	lenovo	model:	thinkcentre m7200z	scope:	eq	version:	fgkt46a	Trust: 1.0
vendor:	lenovo	model:	thinkcentre m6600q	scope:	eq	version:	fwkt39a	Trust: 1.0
vendor:	lenovo	model:	thinkstation e32	scope:	eq	version:	fbktc6a	Trust: 1.0
vendor:	lenovo	model:	thinkcentre m73p	scope:	eq	version:	fbktc5a	Trust: 1.0
vendor:	lenovo	model:	thinkcentre m600	scope:	eq	version:	m00kt44a	Trust: 1.0
vendor:	lenovo	model:	thinkcentre m800z	scope:	eq	version:	fvkt42a	Trust: 1.0
vendor:	lenovo	model:	thinkstation e31	scope:	eq	version:	9skt97a	Trust: 1.0
vendor:	lenovo	model:	thinkserver ts250	scope:	eq	version:	-	Trust: 1.0
vendor:	lenovo	model:	thinkstation p510	scope:	eq	version:	-	Trust: 1.0
vendor:	lenovo	model:	thinkcentre m700	scope:	eq	version:	m05kt54a	Trust: 1.0
vendor:	lenovo	model:	thinkcentre m8200z	scope:	eq	version:	fgkt46a	Trust: 1.0
vendor:	lenovo	model:	thinkcentre edge 62z	scope:	eq	version:	f8kt40a	Trust: 1.0
vendor:	lenovo	model:	thinkserver rs140	scope:	eq	version:	fbkt91c	Trust: 1.0
vendor:	lenovo	model:	thinkstation p320	scope:	eq	version:	-	Trust: 1.0
vendor:	lenovo	model:	thinkcentre m8300z	scope:	eq	version:	fvkt42a	Trust: 1.0
vendor:	lenovo	model:	thinkserver ts150	scope:	eq	version:	fbktc3a	Trust: 1.0
vendor:	lenovo	model:	thinkstation p900	scope:	eq	version:	a6kt86a	Trust: 1.0
vendor:	lenovo	model:	thinkcentre m715q	scope:	eq	version:	-	Trust: 1.0
vendor:	lenovo	model:	thinkcentre x1 aio	scope:	eq	version:	m0hkt32a	Trust: 1.0
vendor:	lenovo	model:	yangtian afh110	scope:	eq	version:	m05kt73a	Trust: 1.0
vendor:	lenovo	model:	thinkcentre e79	scope:	eq	version:	m0lkt12a	Trust: 1.0
vendor:	lenovo	model:	thinkcentre m6500t\/s	scope:	eq	version:	fbktc5a	Trust: 1.0
vendor:	lenovo	model:	thinkcentre m92p	scope:	eq	version:	9skt95a	Trust: 1.0
vendor:	lenovo	model:	thinkcentre m8600t\/s	scope:	eq	version:	fwkt39a	Trust: 1.0
vendor:	lenovo	model:	thinkcentre e74z	scope:	eq	version:	fvkt48a	Trust: 1.0
vendor:	lenovo	model:	thinkserver ts240	scope:	eq	version:	fbktc3a	Trust: 1.0
vendor:	lenovo	model:	thinkserver rq750	scope:	eq	version:	7.05	Trust: 1.0
vendor:	lenovo	model:	thinkcentre m8500t\/s	scope:	eq	version:	fbktc5a	Trust: 1.0
vendor:	lenovo	model:	thinkcentre m7250z	scope:	eq	version:	fgkt46a	Trust: 1.0
vendor:	lenovo	model:	thinkserver ts140	scope:	eq	version:	fbktc3a	Trust: 1.0
vendor:	lenovo	model:	thinkstation p300	scope:	eq	version:	fbktc6a	Trust: 1.0
vendor:	lenovo	model:	thinkcentre e73s	scope:	eq	version:	fckt78a	Trust: 1.0
vendor:	lenovo	model:	yangtian me\/we h110	scope:	eq	version:	m05kt61a	Trust: 1.0
vendor:	lenovo	model:	thinkcentre m800	scope:	eq	version:	fwkt39a	Trust: 1.0
vendor:	lenovo	model:	thinkserver rd540	scope:	eq	version:	a1tsb5a	Trust: 1.0
vendor:	lenovo	model:	thinkcentre e73z \	scope:	eq	version:	fgkt49a	Trust: 1.0
vendor:	lenovo	model:	thinkcentre m93p	scope:	eq	version:	fbktc5a	Trust: 1.0
vendor:	lenovo	model:	thinkstation p410	scope:	eq	version:	-	Trust: 1.0
vendor:	lenovo	model:	thinkcentre m9550z	scope:	eq	version:	fukt44a	Trust: 1.0
vendor:	lenovo	model:	thinkcentre m900z	scope:	eq	version:	fukt39a	Trust: 1.0
vendor:	lenovo	model:	thinkcentre m4600t\/s	scope:	eq	version:	m05kt54a	Trust: 1.0
vendor:	lenovo	model:	thinkcentre m910t\/s	scope:	eq	version:	-	Trust: 1.0
vendor:	lenovo	model:	yangtian mf\/wf h81	scope:	eq	version:	fckt80a	Trust: 1.0
vendor:	lenovo	model:	thinkserver ts450	scope:	eq	version:	-	Trust: 1.0
vendor:	lenovo	model:	thinkcentre e93z \	scope:	eq	version:	ffkt43a	Trust: 1.0
vendor:	lenovo	model:	yangtian mc godavari	scope:	eq	version:	m0lkt13a	Trust: 1.0
vendor:	lenovo	model:	thinkcentre e75 t\/s	scope:	eq	version:	-	Trust: 1.0
vendor:	lenovo	model:	thinkstation p700	scope:	eq	version:	a5kt86a	Trust: 1.0
vendor:	lenovo	model:	s200z	scope:	eq	version:	m09kt33a	Trust: 1.0
vendor:	lenovo	model:	thinkcentre m73	scope:	eq	version:	fckt78a	Trust: 1.0
vendor:	lenovo	model:	yangtian s3040	scope:	eq	version:	fgkt49a	Trust: 1.0
vendor:	lenovo	model:	thinkcentre m4500t\/s	scope:	eq	version:	fckt78a	Trust: 1.0
vendor:	lenovo	model:	thinkcentre m810z	scope:	eq	version:	-	Trust: 1.0
vendor:	lenovo	model:	thinkcentre m900	scope:	eq	version:	fwkt39a	Trust: 1.0
vendor:	lenovo	model:	thinkcentre m6600t\/s	scope:	eq	version:	fwkt39a	Trust: 1.0
vendor:	lenovo	model:	thinkcentre m83z \	scope:	eq	version:	fvkt42a	Trust: 1.0
vendor:	lenovo	model:	ideacentre 300s-11ish	scope:	-	version:	-	Trust: 0.8
vendor:	lenovo	model:	ideacentre 510s-08ish	scope:	-	version:	-	Trust: 0.8
vendor:	lenovo	model:	ideacentre 510s-23isu	scope:	-	version:	-	Trust: 0.8
vendor:	lenovo	model:	ideacentre 700	scope:	-	version:	-	Trust: 0.8
vendor:	lenovo	model:	63	scope:	-	version:	-	Trust: 0.8
vendor:	lenovo	model:	h50-30g desktop	scope:	-	version:	-	Trust: 0.8
vendor:	lenovo	model:	m4500 id	scope:	-	version:	-	Trust: 0.8
vendor:	lenovo	model:	m4500	scope:	-	version:	-	Trust: 0.8
vendor:	lenovo	model:	m4550 id	scope:	-	version:	-	Trust: 0.8
vendor:	lenovo	model:	s200z	scope:	-	version:	-	Trust: 0.8
vendor:	lenovo	model:	s500	scope:	-	version:	-	Trust: 0.8
vendor:	lenovo	model:	v320-15iap	scope:	-	version:	-	Trust: 0.8
vendor:	lenovo	model:	thinkcentre e73	scope:	-	version:	-	Trust: 0.8
vendor:	lenovo	model:	thinkcentre e73z	scope:	-	version:	-	Trust: 0.8
vendor:	lenovo	model:	thinkcentre e74	scope:	-	version:	-	Trust: 0.8
vendor:	lenovo	model:	thinkcentre e74s	scope:	-	version:	-	Trust: 0.8
vendor:	lenovo	model:	thinkcentre e74z	scope:	-	version:	-	Trust: 0.8
vendor:	lenovo	model:	thinkcentre e75 t/s	scope:	-	version:	-	Trust: 0.8
vendor:	lenovo	model:	thinkcentre e79	scope:	-	version:	-	Trust: 0.8
vendor:	lenovo	model:	thinkcentre e93	scope:	-	version:	-	Trust: 0.8
vendor:	lenovo	model:	thinkcentre e93z	scope:	-	version:	-	Trust: 0.8
vendor:	lenovo	model:	thinkcentre edge 62z	scope:	-	version:	-	Trust: 0.8
vendor:	lenovo	model:	thinkcentre m4500q	scope:	-	version:	-	Trust: 0.8
vendor:	lenovo	model:	thinkcentre m4500t/s	scope:	-	version:	-	Trust: 0.8
vendor:	lenovo	model:	thinkcentre m4600t/s	scope:	-	version:	-	Trust: 0.8
vendor:	lenovo	model:	thinkcentre m600	scope:	-	version:	-	Trust: 0.8
vendor:	lenovo	model:	thinkcentre m610	scope:	-	version:	-	Trust: 0.8
vendor:	lenovo	model:	thinkcentre m6500t/s	scope:	-	version:	-	Trust: 0.8
vendor:	lenovo	model:	thinkcentre m6600	scope:	-	version:	-	Trust: 0.8
vendor:	lenovo	model:	thinkcentre m6600q	scope:	-	version:	-	Trust: 0.8
vendor:	lenovo	model:	thinkcentre m6600t/s	scope:	-	version:	-	Trust: 0.8
vendor:	lenovo	model:	thinkcentre m700	scope:	-	version:	-	Trust: 0.8
vendor:	lenovo	model:	thinkcentre m700z	scope:	-	version:	-	Trust: 0.8
vendor:	lenovo	model:	thinkcentre m710t/s	scope:	-	version:	-	Trust: 0.8
vendor:	lenovo	model:	thinkcentre m715q	scope:	-	version:	-	Trust: 0.8
vendor:	lenovo	model:	thinkcentre m7200z	scope:	-	version:	-	Trust: 0.8
vendor:	lenovo	model:	thinkcentre m7250z	scope:	-	version:	-	Trust: 0.8
vendor:	lenovo	model:	thinkcentre m72e	scope:	-	version:	-	Trust: 0.8
vendor:	lenovo	model:	thinkcentre m73	scope:	-	version:	-	Trust: 0.8
vendor:	lenovo	model:	thinkcentre m7300z	scope:	-	version:	-	Trust: 0.8
vendor:	lenovo	model:	thinkcentre m73p	scope:	-	version:	-	Trust: 0.8
vendor:	lenovo	model:	thinkcentre m73z	scope:	-	version:	-	Trust: 0.8
vendor:	lenovo	model:	thinkcentre m79	scope:	-	version:	-	Trust: 0.8
vendor:	lenovo	model:	thinkcentre m800	scope:	-	version:	-	Trust: 0.8
vendor:	lenovo	model:	thinkcentre m800z	scope:	-	version:	-	Trust: 0.8
vendor:	lenovo	model:	thinkcentre m810z	scope:	-	version:	-	Trust: 0.8
vendor:	lenovo	model:	thinkcentre m8200z	scope:	-	version:	-	Trust: 0.8
vendor:	lenovo	model:	thinkcentre m8250z	scope:	-	version:	-	Trust: 0.8
vendor:	lenovo	model:	thinkcentre m83	scope:	-	version:	-	Trust: 0.8
vendor:	lenovo	model:	thinkcentre m8300z	scope:	-	version:	-	Trust: 0.8
vendor:	lenovo	model:	thinkcentre m8350z	scope:	-	version:	-	Trust: 0.8
vendor:	lenovo	model:	thinkcentre m83z	scope:	-	version:	-	Trust: 0.8
vendor:	lenovo	model:	thinkcentre m8500t/s	scope:	-	version:	-	Trust: 0.8
vendor:	lenovo	model:	thinkcentre m8600t/s	scope:	-	version:	-	Trust: 0.8
vendor:	lenovo	model:	thinkcentre m900	scope:	-	version:	-	Trust: 0.8
vendor:	lenovo	model:	thinkcentre m900z	scope:	-	version:	-	Trust: 0.8
vendor:	lenovo	model:	thinkcentre m910 t/s	scope:	-	version:	-	Trust: 0.8
vendor:	lenovo	model:	thinkcentre m910q	scope:	-	version:	-	Trust: 0.8
vendor:	lenovo	model:	thinkcentre m910x	scope:	-	version:	-	Trust: 0.8
vendor:	lenovo	model:	thinkcentre m92	scope:	-	version:	-	Trust: 0.8
vendor:	lenovo	model:	thinkcentre m92p	scope:	-	version:	-	Trust: 0.8
vendor:	lenovo	model:	thinkcentre m93	scope:	-	version:	-	Trust: 0.8
vendor:	lenovo	model:	thinkcentre m93p	scope:	-	version:	-	Trust: 0.8
vendor:	lenovo	model:	thinkcentre m9500z	scope:	-	version:	-	Trust: 0.8
vendor:	lenovo	model:	thinkcentre m9550z	scope:	-	version:	-	Trust: 0.8
vendor:	lenovo	model:	thinkcentre x1 aio	scope:	-	version:	-	Trust: 0.8
vendor:	lenovo	model:	thinkserver rd340	scope:	-	version:	-	Trust: 0.8
vendor:	lenovo	model:	thinkserver rd440	scope:	-	version:	-	Trust: 0.8
vendor:	lenovo	model:	thinkserver rd640	scope:	-	version:	-	Trust: 0.8
vendor:	lenovo	model:	thinkserver rq750	scope:	-	version:	-	Trust: 0.8
vendor:	lenovo	model:	thinkserver rs140	scope:	-	version:	-	Trust: 0.8
vendor:	lenovo	model:	thinkserver td340	scope:	-	version:	-	Trust: 0.8
vendor:	lenovo	model:	thinkserver ts150	scope:	-	version:	-	Trust: 0.8
vendor:	lenovo	model:	thinkserver ts240	scope:	-	version:	-	Trust: 0.8
vendor:	lenovo	model:	thinkserver ts250	scope:	-	version:	-	Trust: 0.8
vendor:	lenovo	model:	thinkserver ts450	scope:	-	version:	-	Trust: 0.8
vendor:	lenovo	model:	thinkserver ts550	scope:	-	version:	-	Trust: 0.8
vendor:	lenovo	model:	thinkstation e31	scope:	-	version:	-	Trust: 0.8
vendor:	lenovo	model:	thinkstation e32	scope:	-	version:	-	Trust: 0.8
vendor:	lenovo	model:	thinkstation p300	scope:	-	version:	-	Trust: 0.8
vendor:	lenovo	model:	thinkstation p310	scope:	-	version:	-	Trust: 0.8
vendor:	lenovo	model:	thinkstation p320	scope:	-	version:	-	Trust: 0.8
vendor:	lenovo	model:	thinkstation p410	scope:	-	version:	-	Trust: 0.8
vendor:	lenovo	model:	thinkstation p500	scope:	-	version:	-	Trust: 0.8
vendor:	lenovo	model:	thinkstation p700	scope:	-	version:	-	Trust: 0.8
vendor:	lenovo	model:	thinkstation p710	scope:	-	version:	-	Trust: 0.8
vendor:	lenovo	model:	thinkstation p900	scope:	-	version:	-	Trust: 0.8
vendor:	lenovo	model:	yangtian afh110	scope:	-	version:	-	Trust: 0.8
vendor:	lenovo	model:	yangtian afh81	scope:	-	version:	-	Trust: 0.8
vendor:	lenovo	model:	yangtian afq150	scope:	-	version:	-	Trust: 0.8
vendor:	lenovo	model:	yangtian mc carrizo-l	scope:	-	version:	-	Trust: 0.8
vendor:	lenovo	model:	yangtian mc godavari	scope:	-	version:	-	Trust: 0.8
vendor:	lenovo	model:	yangtian mc h110	scope:	-	version:	-	Trust: 0.8
vendor:	lenovo	model:	yangtian mc h81	scope:	-	version:	-	Trust: 0.8
vendor:	lenovo	model:	yangtian me/we h110	scope:	-	version:	-	Trust: 0.8
vendor:	lenovo	model:	yangtian mf/wf h81	scope:	-	version:	-	Trust: 0.8
vendor:	lenovo	model:	yangtian s3040	scope:	-	version:	-	Trust: 0.8
vendor:	lenovo	model:	yangtian s800	scope:	-	version:	-	Trust: 0.8
vendor:	lenovo	model:	thinkstation	scope:	eq	version:	0	Trust: 0.3
vendor:	lenovo	model:	thinkserver	scope:	eq	version:	0	Trust: 0.3
vendor:	lenovo	model:	desktop all in one	scope:	eq	version:	-0	Trust: 0.3
vendor:	lenovo	model:	desktop	scope:	eq	version:	0	Trust: 0.3

sources: CNVD: CNVD-2017-28413 // BID: 100488 // JVNDB: JVNDB-2017-007403 // CNNVD: CNNVD-201708-381 // NVD: CVE-2017-3753

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2017-3753
value:	MEDIUM
Trust: 1.0
NVD:	CVE-2017-3753
value:	MEDIUM
Trust: 0.8
CNVD:	CNVD-2017-28413
value:	MEDIUM
Trust: 0.6
CNNVD:	CNNVD-201708-381
value:	HIGH
Trust: 0.6
VULHUB:	VHN-111956
value:	HIGH
Trust: 0.1

nvd@nist.gov:	CVE-2017-3753
severity:	HIGH
baseScore:	7.2
vectorString:	AV:L/AC:L/AU:N/C:C/I:C/A:C
accessVector:	LOCAL
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	3.9
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
CNVD:	CNVD-2017-28413
severity:	MEDIUM
baseScore:	4.3
vectorString:	AV:N/AC:M/AU:N/C:P/I:N/A:N
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	8.6
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6
VULHUB:	VHN-111956
severity:	HIGH
baseScore:	7.2
vectorString:	AV:L/AC:L/AU:N/C:C/I:C/A:C
accessVector:	LOCAL
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	3.9
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

nvd@nist.gov:	CVE-2017-3753
baseSeverity:	MEDIUM
baseScore:	6.8
vectorString:	CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector:	PHYSICAL
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	0.9
impactScore:	5.9
version:	3.0
Trust: 1.8

sources: CNVD: CNVD-2017-28413 // VULHUB: VHN-111956 // JVNDB: JVNDB-2017-007403 // CNNVD: CNNVD-201708-381 // NVD: CVE-2017-3753

PROBLEMTYPE DATA

problemtype:

CWE-94

Trust: 1.9

sources: VULHUB: VHN-111956 // JVNDB: JVNDB-2017-007403 // NVD: CVE-2017-3753

THREAT TYPE

local

Trust: 0.9

sources: BID: 100488 // CNNVD: CNNVD-201708-381

TYPE

code injection

Trust: 0.6

sources: CNNVD: CNNVD-201708-381

CONFIGURATIONS

sources: JVNDB: JVNDB-2017-007403

PATCH

title:	LEN-14695	url:	https://support.lenovo.com/us/ja/product_security/len-14695	Trust: 0.8
title:	A variety of Lenovo product BIOSSMIHandler bypasses the system protection vulnerability patch	url:	https://www.cnvd.org.cn/patchInfo/show/102850	Trust: 0.6
title:	Multiple Lenovo product BIOS SMI Handler Security vulnerabilities	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=73847	Trust: 0.6

sources: CNVD: CNVD-2017-28413 // JVNDB: JVNDB-2017-007403 // CNNVD: CNNVD-201708-381

EXTERNAL IDS

db:	NVD	id:	CVE-2017-3753	Trust: 3.4
db:	LENOVO	id:	LEN-14695	Trust: 2.6
db:	JVNDB	id:	JVNDB-2017-007403	Trust: 0.8
db:	CNNVD	id:	CNNVD-201708-381	Trust: 0.7
db:	CNVD	id:	CNVD-2017-28413	Trust: 0.6
db:	BID	id:	100488	Trust: 0.4
db:	VULHUB	id:	VHN-111956	Trust: 0.1

sources: CNVD: CNVD-2017-28413 // VULHUB: VHN-111956 // BID: 100488 // JVNDB: JVNDB-2017-007403 // CNNVD: CNNVD-201708-381 // NVD: CVE-2017-3753

REFERENCES

url:	https://support.lenovo.com/us/en/product_security/len-14695	Trust: 2.0
url:	http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-3753	Trust: 0.8
url:	https://nvd.nist.gov/vuln/detail/cve-2017-3753	Trust: 0.8
url:	https://support.lenovo.com/us/zh/product_security/len-14695	Trust: 0.6
url:	http://www.lenovo.com/ca/en/	Trust: 0.3

sources: CNVD: CNVD-2017-28413 // VULHUB: VHN-111956 // BID: 100488 // JVNDB: JVNDB-2017-007403 // CNNVD: CNNVD-201708-381 // NVD: CVE-2017-3753

CREDITS

Alex Matrosov, Principal Research Scientist, Cylance.

Trust: 0.3

sources: BID: 100488

SOURCES

db:	CNVD	id:	CNVD-2017-28413
db:	VULHUB	id:	VHN-111956
db:	BID	id:	100488
db:	JVNDB	id:	JVNDB-2017-007403
db:	CNNVD	id:	CNNVD-201708-381
db:	NVD	id:	CVE-2017-3753

LAST UPDATE DATE

2024-11-23T22:45:36.995000+00:00

SOURCES UPDATE DATE

db:	CNVD	id:	CNVD-2017-28413	date:	2017-09-26T00:00:00
db:	VULHUB	id:	VHN-111956	date:	2017-08-29T00:00:00
db:	BID	id:	100488	date:	2017-07-27T00:00:00
db:	JVNDB	id:	JVNDB-2017-007403	date:	2017-09-20T00:00:00
db:	CNNVD	id:	CNNVD-201708-381	date:	2017-08-25T00:00:00
db:	NVD	id:	CVE-2017-3753	date:	2024-11-21T03:26:04.303

SOURCES RELEASE DATE

db:	CNVD	id:	CNVD-2017-28413	date:	2017-09-26T00:00:00
db:	VULHUB	id:	VHN-111956	date:	2017-08-10T00:00:00
db:	BID	id:	100488	date:	2017-07-27T00:00:00
db:	JVNDB	id:	JVNDB-2017-007403	date:	2017-09-20T00:00:00
db:	CNNVD	id:	CNNVD-201708-381	date:	2017-08-25T00:00:00
db:	NVD	id:	CVE-2017-3753	date:	2017-08-10T00:29:00.230