CVE-2017-3771

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

System boot process is not adequately secured In Lenovo E95 and ThinkCentre M710s/M710t because systems were shipped from factory without completing BIOS/UEFI initialization process.

Metrics

CVSS 3.0 7.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Affected software

Vendor	Product	Versions
Lenovo Group Ltd.	E95, ThinkCentre M710s/M710t	Earlier than 1.3.2

References

https://support.lenovo.com/us/en/product_security/LEN-17417Issue Tracking, Vendor Advisory
https://support.lenovo.com/us/en/product_security/LEN-17417Issue Tracking, Vendor Advisory

Timeline

Published: Oct 26, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-37725.5A vulnerability was reported in Lenovo PC Manager versions prior to 2.6.40.3154 that could allow an attacker to cause a system reboot.CVE-2017-37749.8A stack overflow vulnerability was discovered within the web administration service in Integrated Management Module 2 (IMM2) earlier than ve CVE-2017-37756.4Some Lenovo System x server BIOS/UEFI versions, when Secure Boot mode is enabled by a system administrator, do not properly authenticate sig CVE-2017-37767.5Lenovo Help Android mobile app versions earlier than 6.1.2.0327 allowed information to be transmitted over an HTTP channel, permitting other CVE-2017-37908.6A vulnerability in the received packet parser of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) software co CVE-2017-379110.0A vulnerability in the web-based GUI of Cisco Prime Home could allow an unauthenticated, remote attacker to bypass authentication and execut CVE-2017-37929.8A vulnerability in a proprietary device driver in the kernel of Cisco TelePresence Multipoint Control Unit (MCU) Software could allow an una CVE-2017-37934.0A vulnerability in the TCP normalizer of Cisco Adaptive Security Appliance (ASA) Software (8.0 through 8.7 and 9.0 through 9.6) and Cisco Fi CVE-2017-37948.8A vulnerability in Cisco WebEx Meetings Server could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF CVE-2017-37955.4A vulnerability in Cisco WebEx Meetings Server could allow an authenticated, remote attacker to conduct arbitrary password changes against a CVE-2017-37967.2A vulnerability in Cisco WebEx Meetings Server could allow an authenticated, remote attacker to execute predetermined shell commands on othe CVE-2017-37975.3A vulnerability in Cisco WebEx Meetings Server could allow an unauthenticated, remote attacker to view the fully qualified domain name of th