CVE-2017-3771

Severity: high (CVSS 7.5 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2017-10-26 · updated 2026-06-17

Description

System boot process is not adequately secured In Lenovo E95 and ThinkCentre M710s/M710t because systems were shipped from factory without completing BIOS/UEFI initialization process.

Affected products

Lenovo Aio E95 Firmware: before m16kt40a — fixed in m16kt40a
Lenovo Thinkcentre M710S Firmware: before m16kt40a — fixed in m16kt40a
Lenovo Thinkcentre M710T Firmware: before m16kt40a — fixed in m16kt40a

How to fix

Upgrade to a fixed version: Lenovo Aio E95 Firmware m16kt40a; Lenovo Thinkcentre M710S Firmware m16kt40a; Lenovo Thinkcentre M710T Firmware m16kt40a. Check the vendor advisory for mitigations.

References

https://support.lenovo.com/us/en/product_security/LEN-17417
https://support.lenovo.com/us/en/product_security/LEN-17417

Get alerted when CVE-2017-3771 or the next vulnerability affects your stack