CVE-2017-3747

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

Privilege escalation vulnerability in Lenovo Nerve Center for Windows 10 on Desktop systems (Lenovo Nerve Center for notebook systems is not affected) that could allow an attacker with local privileges on a system to alter registry keys.

Metrics

CVSS 3.0 5.5/10CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Affected software

Vendor	Product	Versions
Lenovo Group Ltd.	Lenovo Nerve Center	Earlier than 1.70.0426

References

http://www.securityfocus.com/bid/99286Third Party Advisory, VDB Entry
https://support.lenovo.com/us/en/product_security/LEN-15046Vendor Advisory
http://www.securityfocus.com/bid/99286Third Party Advisory, VDB Entry
https://support.lenovo.com/us/en/product_security/LEN-15046Vendor Advisory

Timeline

Published: Jun 29, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-37487.8On Lenovo VIBE mobile phones, improper access controls on the nac_server component can be abused in conjunction with CVE-2017-3749 and CVE-2 CVE-2017-37496.4On Lenovo VIBE mobile phones, the Idea Friend Android application allows private data to be backed up and restored via Android Debug Bridge,CVE-2017-37506.4On Lenovo VIBE mobile phones, the Lenovo Security Android application allows private data to be backed up and restored via Android Debug Bri CVE-2017-37517.8An unquoted service path vulnerability was identified in the driver for the ThinkPad Compact USB Keyboard with TrackPoint versions earlier t CVE-2017-37528.2An industry-wide vulnerability has been identified in the implementation of the Open Shortest Path First (OSPF) routing protocol used on som CVE-2017-37536.8A vulnerability has been identified in some Lenovo products that use UEFI (BIOS) code developed by American Megatrends, Inc. (AMI). With thi CVE-2017-37546.7Some Lenovo brand notebook systems do not have write protections properly configured in the system BIOS. This could enable an attacker with CVE-2017-37567.8A privilege escalation vulnerability was identified in Lenovo Active Protection System for ThinkPad systems versions earlier than 1.82.0.17.CVE-2017-37577.8An unquoted service path vulnerability was identified in the driver for the ElanTech Touchpad, various versions, used on some Lenovo brand n CVE-2017-37589.8Improper access controls on several Android components in the Lenovo Service Framework application can be exploited to enable remote code ex CVE-2017-37598.1The Lenovo Service Framework Android application accepts some responses from the server without proper validation. This exposes the applicat CVE-2017-37608.1The Lenovo Service Framework Android application uses a set of nonsecure credentials when performing integrity verification of downloaded ap