CVEvulnerability

CVE-2017-3775

6.4 MEDIUM Published 2018-05-04 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2018-05-04
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.0 ([email protected])
6.4 MEDIUM — CVSS:3.0/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected])
6.9 MEDIUM — AV:L/AC:M/Au:N/C:C/I:C/A:C
Weaknesses
CWE-287

Description

Some Lenovo System x server BIOS/UEFI versions, when Secure Boot mode is enabled by a system administrator, do not properly authenticate signed code before booting it. As a result, an attacker with physical access to the system could boot unsigned code.

Affected configurations

• lenovo flex system x240 m5 bios (< 2.61) • lenovo flex system x280 x6 bios (< 4.21) • lenovo flex system x480 x6 bios (< 4.21) • lenovo flex system x880 bios (< 4.21) • lenovo nextscale nx360 m5 bios (< 2.61) • lenovo system x3250 m6 bios (< 2.23) • lenovo system x3500 m5 bios (< 2.61) • lenovo system x3550 m5 bios (< 2.61) • lenovo system x3650 m5 bios (< 2.61) • lenovo system x3850 x6 bios (< 4.3) • lenovo system x3950 x6 bios (< 4.3)

Related

Weakness · CWE (1)

  • CWE-287 Improper Authentication weakness

References