How severe is CVE-2017-3754?

Medium severity. CVSS v3 base score is 6.7 out of 10.

Vulnerability in Lenovo 710s-13ikb\/xiaoxin Air 13ikb

CVE-2017-3754

Some Lenovo brand notebook systems do not have write protections properly configured in the system BIOS. This could enable an attacker with physical or administrative access to a system to be able to flash the BIOS with an arbitrary image and potentially run malicious BIOS code.

EPSS: 0.003 (26.3th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.7 (Medium). Vector: CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H.

Affected products

Lenovo 710s-13ikb\/xiaoxin_air_13ikb
Lenovo 710s-13isk\/xiaoxin_air_13
Lenovo Bios
Lenovo K21-80
Lenovo K22-80\/lenovo_v720-12
Lenovo K41-80
Lenovo Lenovo_ideapad_110-14ast
Lenovo Lenovo_ideapad_110-15ast
Lenovo Lenovo_ideapad_320-14ast
Lenovo Lenovo_ideapad_320-15ast

References

psirt@lenovo.com (x_refsource_CONFIRM, Vendor Advisory)

Frequently asked questions

What is CVE-2017-3754?: CVE-2017-3754 is a medium-severity vulnerability in Lenovo 710s-13ikb\/xiaoxin Air 13ikb. CVSS score: 6.7/10. Published 2017-07-17.
How severe is CVE-2017-3754?: Medium severity. CVSS v3 base score is 6.7 out of 10.