What’s Vulnerable › Vulnerabilities

CVE-2017-3756

• Severity: high (CVSS 7.8 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2017-08-18 · updated 2026-06-17

Description

A privilege escalation vulnerability was identified in Lenovo Active Protection System for ThinkPad systems versions earlier than 1.82.0.17. An attacker with local privileges could execute code with administrative privileges via an unquoted service path.

Affected products

• Lenovo Thinkpad 10 Ella 2: all versions
• Lenovo Thinkpad 10 Ella 2 Bios: all versions
• Lenovo Thinkpad 11E Beema: all versions
• Lenovo Thinkpad 11E Beema Bios: all versions
• Lenovo Thinkpad 11E Braswell: all versions
• Lenovo Thinkpad 11E Braswell Bios: all versions
• Lenovo Thinkpad 11E Broadwell: all versions
• Lenovo Thinkpad 11E Broadwell Bios: all versions
• Lenovo Thinkpad 11E Skylake: all versions
• Lenovo Thinkpad 11E Skylake Bios: all versions
• Lenovo Thinkpad 13E: all versions
• Lenovo Thinkpad 13E Bios: all versions
• Lenovo Thinkpad E450: all versions
• Lenovo Thinkpad E450 Bios: all versions
• Lenovo Thinkpad E450C: all versions
• Lenovo Thinkpad E450C Bios: all versions
• Lenovo Thinkpad E455: all versions
• Lenovo Thinkpad E455 Bios: all versions
• Lenovo Thinkpad E460: all versions
• Lenovo Thinkpad E460 Bios: all versions
• Lenovo Thinkpad E465: all versions
• Lenovo Thinkpad E465 Bios: all versions
• Lenovo Thinkpad E550: all versions
• Lenovo Thinkpad E550 Bios: all versions
• Lenovo Thinkpad E550C: all versions
• Lenovo Thinkpad E550C Bios: all versions
• Lenovo Thinkpad E555: all versions
• Lenovo Thinkpad E555 Bios: all versions
• Lenovo Thinkpad E560: all versions
• Lenovo Thinkpad E560 Bios: all versions

References

• http://www.securityfocus.com/bid/100305
• https://support.lenovo.com/us/en/product_security/LEN-15765
• http://www.securityfocus.com/bid/100305
• https://support.lenovo.com/us/en/product_security/LEN-15765

Get alerted when CVE-2017-3756 or the next vulnerability affects your stack