Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
cve[email protected]CVE-2017-3749
HistoryJun 29, 2017 - 3:29 p.m.

CVE-2017-3749

2017-06-2915:29:00
[email protected]
web.nvd.nist.gov
22
lenovo vibe
idea friend
android app
adb
tampering
privilege escalation
cve-2017-3749
cve-2017-3748
cve-2017-3750

6.9 Medium

CVSS2

Attack Vector

LOCAL

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:M/Au:N/C:C/I:C/A:C

6.4 Medium

CVSS3

Attack Vector

PHYSICAL

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

6.6 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

21.6%

JSON

On Lenovo VIBE mobile phones, the Idea Friend Android application allows private data to be backed up and restored via Android Debug Bridge, which allows tampering leading to privilege escalation in conjunction with CVE-2017-3748 and CVE-2017-3750.

Affected configurations

NVD
Node
googleandroidRange≤5.1.1
AND
lenovovibe_a1600Match-
OR
lenovovibe_a2560Match-
OR
lenovovibe_a2800Match-
OR
lenovovibe_a2860Match-
OR
lenovovibe_a2880Match-
OR
lenovovibe_a3000Match-
OR
lenovovibe_a3500Match-
OR
lenovovibe_a3600-dMatch-
OR
lenovovibe_a3600uMatch-
OR
lenovovibe_a3800-dMatch-
OR
lenovovibe_a3900Match-
OR
lenovovibe_a6000Match-
OR
lenovovibe_a6000-iMatch-
OR
lenovovibe_a6020i37Match-
OR
lenovovibe_a6600Match-
OR
lenovovibe_a6800Match-
OR
lenovovibe_k30-eMatch-
OR
lenovovibe_k30-w-cuMatch-
OR
lenovovibe_k32c30Match-
OR
lenovovibe_k80mMatch-
CPENameOperatorVersion
google:androidgoogle androidle5.1.1

CNA Affected

[
  {
    "product": "Lenovo Vibe and Lenovo China-only Moto Mobile Phones",
    "vendor": "Lenovo Group Ltd.",
    "versions": [
      {
        "status": "affected",
        "version": "Earlier than 6.0"
      }
    ]
  }
]

Related

cve 2
fireeye 2
prion 3
cvelist 3
nvd 3
lenovo 2
cve
cve
CVE-2017-3750
2017-06-29 15:29:00
CVE-2017-3748
2017-06-29 15:29:00
fireeye
fireeye
Back That App Up: Gaining Root on the Lenovo Vibe
2017-06-29 12:30:00
Back That App Up: Gaining Root on the Lenovo Vibe
2017-06-29 12:30:00
prion
prion
Privilege escalation
2017-06-29 15:29:00
Improper access control
2017-06-29 15:29:00
Privilege escalation
2017-06-29 15:29:00
cvelist
cvelist
CVE-2017-3748
2017-06-22 00:00:00
CVE-2017-3749
2017-06-28 00:00:00
CVE-2017-3750
2017-06-28 00:00:00
nvd
nvd
CVE-2017-3749
2017-06-29 15:29:00
CVE-2017-3748
2017-06-29 15:29:00
CVE-2017-3750
2017-06-29 15:29:00
lenovo
lenovo
Local Root Exploit on Lenovo VIBE Mobile Phones - us
2017-06-23 00:00:00
Local Root Exploit on Lenovo VIBE Mobile Phones - Lenovo Support US
2017-06-23 00:00:00

6.9 Medium

CVSS2

Attack Vector

LOCAL

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:M/Au:N/C:C/I:C/A:C

6.4 Medium

CVSS3

Attack Vector

PHYSICAL

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

6.6 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

21.6%

JSON
Related for CVE-2017-3749
cve2fireeye2prion3cvelist3nvd3lenovo2