CVE-2017-3760

8.1HIGH

Key Information:

Vendor
Lenovo
Status
Service Framework Application
Vendor
CVE Published:
17 October 2017

Summary

The Lenovo Service Framework Android application uses a set of nonsecure credentials when performing integrity verification of downloaded applications and/or data. This exposes the application to man-in-the-middle attacks leading to possible remote code execution.

Affected Version(s)

Service Framework application various versions

References

https://support.lenovo.com/us/en/product_security/LEN-15374
x_refsource_CONFIRM

CVSS V3.1

Score:
8.1
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.