CVE-2017-3775

N/A

Published: May 4, 2018 at 04:00 PM UTC

Updated: June 17, 2026 at 01:18 AM UTC

24 products affected across 1 vendorSystem X3950 X6 BIOSFlex System X480 X6 BIOSSystem X3250 M6 BIOS

Using Some Lenovo Flex System and Lenovo System x products by Lenovo Group Ltd.?

Get instant alerts when new vulnerabilities affect Some Lenovo Flex System and Lenovo System x products - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

N/A

Exploit prediction

EPSS 0.3%

Description

Some Lenovo System x server BIOS/UEFI versions, when Secure Boot mode is enabled by a system administrator, do not properly authenticate signed code before booting it. As a result, an attacker with physical access to the system could boot unsigned code.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Flex System X240 M5 BIOS · Lenovo

95%

v < 2.61

Affected range stops below 2.61, so it looks safe — our inference, not a vendor statement

lenovo-flex-system-x240-m5 (same device)

Flex System X280 X6 BIOS · Lenovo

95%

v < 4.21

Affected range stops below 4.21, so it looks safe — our inference, not a vendor statement

lenovo-flex-system-x280-x6 (same device)

Flex System X480 X6 BIOS · Lenovo

95%

v < 4.21

Affected range stops below 4.21, so it looks safe — our inference, not a vendor statement

lenovo-flex-system-x480-x6 (same device)

Flex System X880 BIOS · Lenovo

95%

v < 4.21

Affected range stops below 4.21, so it looks safe — our inference, not a vendor statement

lenovo-flex-system-x880 (same device)

Nextscale NX360 M5 BIOS · Lenovo

95%

v < 2.61

Affected range stops below 2.61, so it looks safe — our inference, not a vendor statement

lenovo-nextscale-nx360-m5 (same device)

System X3250 M6 BIOS · Lenovo

95%

v < 2.23

Affected range stops below 2.23, so it looks safe — our inference, not a vendor statement

lenovo-system-x3250-m6 (same device)

System X3500 M5 BIOS · Lenovo

95%

v < 2.61

Affected range stops below 2.61, so it looks safe — our inference, not a vendor statement

lenovo-system-x3500-m5 (same device)

System X3550 M5 BIOS · Lenovo

95%

v < 2.61

Affected range stops below 2.61, so it looks safe — our inference, not a vendor statement

lenovo-system-x3550-m5 (same device)

System X3650 M5 BIOS · Lenovo

95%

v < 2.61

Affected range stops below 2.61, so it looks safe — our inference, not a vendor statement

lenovo-system-x3650-m5 (same device)

System X3850 X6 BIOS · Lenovo

95%

v < 4.3

Affected range stops below 4.3, so it looks safe — our inference, not a vendor statement

lenovo-system-x3850-x6 (same device)

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

Patch and advisory references

https://support.lenovo.com/us/en/solutions/LEN-20241

References (1)

x_refsource_CONFIRMPatchVendor Advisory

Source: [email protected]

https://support.lenovo.com/us/en/solutions/LEN-20241

CVSS

6.9MEDIUM[email protected]

Confidentiality: COMPLETE
Integrity: COMPLETE
Availability: COMPLETE

Vector?

Quick Info

StatusMODIFIED

CWE

CWE-287

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create account Sign in

Free plan, no card