CVE-2017-3748

7.8HIGH

Key Information:

Vendor
Lenovo
Status
Lenovo Vibe And Lenovo China-only Moto Mobile Phones
Vendor
CVE Published:
22 June 2017

Summary

On Lenovo VIBE mobile phones, improper access controls on the nac_server component can be abused in conjunction with CVE-2017-3749 and CVE-2017-3750 to elevate privileges to the root user (commonly known as 'rooting' or "jail breaking" a device).

Affected Version(s)

Lenovo Vibe and Lenovo China-only Moto Mobile Phones Earlier than 6.0

References

http://www.securityfocus.com/bid/99295
vdb-entryx_refsource_BID
https://support.lenovo.com/us/en/product_security/LEN-15823
x_refsource_CONFIRM

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.