CVE-2017-3775 json
Some Lenovo System x server BIOS/UEFI versions, when Secure Boot mode is enabled by a system administrator, do not properly authenticate si…
published 2018-05-04 8 y ago modified 2026-06-17 4 mo ago also EUVD-2017-12892
- cvss
- 6.4
- version 3.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 18%
- public exploits
- 0
- none known
Summary
Some Lenovo System x server BIOS/UEFI versions, when Secure Boot mode is enabled by a system administrator, do not properly authenticate signed code before booting it. As a result, an attacker with physical access to the system could boot unsigned code.
Patch / fix
- lenovo flex_system_x240_m5_bios 2.61
- lenovo flex_system_x280_x6_bios 4.21
- lenovo flex_system_x480_x6_bios 4.21
- lenovo flex_system_x880_bios 4.21
- lenovo nextscale_nx360_m5_bios 2.61
- lenovo system_x3250_m6_bios 2.23
- lenovo system_x3500_m5_bios 2.61
- lenovo system_x3550_m5_bios 2.61
- lenovo system_x3650_m5_bios 2.61
- lenovo system_x3850_x6_bios 4.3
- lenovo system_x3950_x6_bios 4.3
Exploit prediction
0.27% chance of exploitation in the next 30 days, higher than 18% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.0 | 6.4 | CVSS:3.0/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 6.9 | AV:L/AC:M/Au:N/C:C/I:C/A:C |
Affected products
- Lenovo Group Ltd. Some Lenovo Flex System and Lenovo System x products
Classification
- Weakness
-
- CWE-287 Improper Authentication
References
-
support.lenovo.com
/us/en/solutions/LEN-20241
patch, vendor-advisory
Sources
- CVE List CVE-2017-3775
- NVD CVE-2017-3775
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.