CVE-2017-3757

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

An unquoted service path vulnerability was identified in the driver for the ElanTech Touchpad, various versions, used on some Lenovo brand notebooks (not ThinkPads). This could allow an attacker with local privileges to execute code with administrative privileges.

Metrics

CVSS 3.0 7.8/10CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-428

Affected software

No affected versions have been published.

Timeline

Published: Aug 29, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-37589.8Improper access controls on several Android components in the Lenovo Service Framework application can be exploited to enable remote code ex CVE-2017-37598.1The Lenovo Service Framework Android application accepts some responses from the server without proper validation. This exposes the applicat CVE-2017-37608.1The Lenovo Service Framework Android application uses a set of nonsecure credentials when performing integrity verification of downloaded ap CVE-2017-37619.8The Lenovo Service Framework Android application executes some system commands without proper sanitization of external input. In certain cas CVE-2017-37627.8Sensitive data stored by Lenovo Fingerprint Manager Pro, version 8.01.86 and earlier, including users' Windows logon credentials and fingerp CVE-2017-37636.7An attacker who obtains access to the location where the LXCA file system is stored may be able to access credentials of local LXCA accounts CVE-2017-37645.3A vulnerability was identified in Lenovo XClarity Administrator (LXCA) before 1.4.0 where LXCA user account names may be exposed to unauthen CVE-2017-37657.0In Enterprise Networking Operating System (ENOS) in Lenovo and IBM RackSwitch and BladeCenter products, an authentication bypass known as "H CVE-2017-37677.8A local privilege escalation vulnerability was identified in the Realtek audio driver versions prior to 6.0.1.8224 in some Lenovo ThinkPad p CVE-2017-37687.5An unprivileged attacker with connectivity to the IMM2 could cause a denial of service attack on the IMM2 (Versions earlier than 4.4 for Len CVE-2017-37708.8Privilege escalation vulnerability in LXCA versions earlier than 1.3.2 where an authenticated user may be able to abuse certain web interfac CVE-2017-37717.5System boot process is not adequately secured In Lenovo E95 and ThinkCentre M710s/M710t because systems were shipped from factory without co