CVE-2017-3752

HighCVSS 8.2/10Last modified Jun 17, 2026

Description

An industry-wide vulnerability has been identified in the implementation of the Open Shortest Path First (OSPF) routing protocol used on some Lenovo switches. Exploitation of these implementation flaws may result in attackers being able to erase or alter the routing tables of one or many routers, switches, or other devices that support OSPF within a routing domain.

Metrics

CVSS 3.0 8.2/10CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:H

Weakness enumeration

CWE-20

Affected software

Vendor	Product	Versions
Lenovo Group Ltd.	Lenovo and IBM Switch Products	Various

References

http://www.securityfocus.com/bid/99995Third Party Advisory, VDB Entry
https://support.lenovo.com/us/en/product_security/LEN-14078Vendor Advisory
http://www.securityfocus.com/bid/99995Third Party Advisory, VDB Entry
https://support.lenovo.com/us/en/product_security/LEN-14078Vendor Advisory

Timeline

Published: Aug 9, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-37536.8A vulnerability has been identified in some Lenovo products that use UEFI (BIOS) code developed by American Megatrends, Inc. (AMI). With thi CVE-2017-37546.7Some Lenovo brand notebook systems do not have write protections properly configured in the system BIOS. This could enable an attacker with CVE-2017-37567.8A privilege escalation vulnerability was identified in Lenovo Active Protection System for ThinkPad systems versions earlier than 1.82.0.17.CVE-2017-37577.8An unquoted service path vulnerability was identified in the driver for the ElanTech Touchpad, various versions, used on some Lenovo brand n CVE-2017-37589.8Improper access controls on several Android components in the Lenovo Service Framework application can be exploited to enable remote code ex CVE-2017-37598.1The Lenovo Service Framework Android application accepts some responses from the server without proper validation. This exposes the applicat CVE-2017-37608.1The Lenovo Service Framework Android application uses a set of nonsecure credentials when performing integrity verification of downloaded ap CVE-2017-37619.8The Lenovo Service Framework Android application executes some system commands without proper sanitization of external input. In certain cas CVE-2017-37627.8Sensitive data stored by Lenovo Fingerprint Manager Pro, version 8.01.86 and earlier, including users' Windows logon credentials and fingerp CVE-2017-37636.7An attacker who obtains access to the location where the LXCA file system is stored may be able to access credentials of local LXCA accounts CVE-2017-37645.3A vulnerability was identified in Lenovo XClarity Administrator (LXCA) before 1.4.0 where LXCA user account names may be exposed to unauthen CVE-2017-37657.0In Enterprise Networking Operating System (ENOS) in Lenovo and IBM RackSwitch and BladeCenter products, an authentication bypass known as "H