1. Home
  2. CVE Database
  3. CVE-2017-3775
MEDIUM · 6.4

CVE-2017-3775

Some Lenovo System x server BIOS/UEFI versions, when Secure Boot mode is enabled by a system administrator, do not properly authenticate signed code before booting it. As a result, an attacker with ph...

Vulnerability Description

Some Lenovo System x server BIOS/UEFI versions, when Secure Boot mode is enabled by a system administrator, do not properly authenticate signed code before booting it. As a result, an attacker with physical access to the system could boot unsigned code.

CVSS Score

6.4

MEDIUM

CVSS:3.0/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector
PHYSICAL
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
HIGH

Affected Products

VendorProductVersions
LenovoFlex System X240 M5 Bios< 2.61
LenovoFlex System X240 M5-
LenovoFlex System X280 X6 Bios< 4.21
LenovoFlex System X280 X6-
LenovoFlex System X480 X6 Bios< 4.21
LenovoFlex System X480 X6-
LenovoFlex System X880 Bios< 4.21
LenovoFlex System X880-
LenovoNextscale Nx360 M5 Bios< 2.61
LenovoNextscale Nx360 M5-
LenovoSystem X3250 M6 Bios< 2.23
LenovoSystem X3250 M6-
LenovoSystem X3500 M5 Bios< 2.61
LenovoSystem X3500 M5-
LenovoSystem X3550 M5 Bios< 2.61
LenovoSystem X3550 M5-
LenovoSystem X3650 M5 Bios< 2.61
LenovoSystem X3650 M5-
LenovoSystem X3850 X6 Bios< 4.3
LenovoSystem X3850 X6-

Related Weaknesses (CWE)

CWE-287

References

FAQ

What is CVE-2017-3775?

CVE-2017-3775 is a vulnerability with a CVSS score of 6.4 (MEDIUM). Some Lenovo System x server BIOS/UEFI versions, when Secure Boot mode is enabled by a system administrator, do not properly authenticate signed code before booting it. As a result, an attacker with ph...

How severe is CVE-2017-3775?

CVE-2017-3775 has been rated MEDIUM with a CVSS base score of 6.4/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2017-3775?

Check the references section above for vendor advisories and patch information. Affected products include: Lenovo Flex System X240 M5 Bios, Lenovo Flex System X240 M5, Lenovo Flex System X280 X6 Bios, Lenovo Flex System X280 X6, Lenovo Flex System X480 X6 Bios.