Android Application Vulnerability in Lenovo Service Framework
CVE-2017-3760

8.1HIGH

Key Information:

Vendor
Lenovo
Status
Service Framework Application
Vendor
CVE Published:
17 October 2017

Summary

The Lenovo Service Framework Android application employs insecure credentials during the integrity verification of downloaded applications and data. This flaw exposes users to man-in-the-middle attacks, allowing malicious actors to intercept communications and potentially execute remote code, placing sensitive information and device integrity at risk.

Affected Version(s)

Service Framework application various versions

References

https://support.lenovo.com/us/en/product_security/LEN-15374
x_refsource_CONFIRM

CVSS V3.1

Score:
8.1
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.