Lucene search

LenovoCVE-2017-3757

HistoryAug 29, 2017 - 1:35 a.m.

CVE-2017-3757

2017-08-2901:35:13

CWE-428

lenovo

web.nvd.nist.gov

cve-2017-3757

unquoted service path

local privilege escalation

elantech touchpad

lenovo

driver vulnerability

CVSS2

7.2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

7.8

Confidence

High

EPSS

Percentile

5.1%

JSON

An unquoted service path vulnerability was identified in the driver for the ElanTech Touchpad, various versions, used on some Lenovo brand notebooks (not ThinkPads). This could allow an attacker with local privileges to execute code with administrative privileges.

Affected configurations

Nvd

Node

emcelan_touchpad_driverRange≤11.4.1.6

VendorProductVersionCPE
emcelan_touchpad_driver*cpe:2.3:a:emc:elan_touchpad_driver:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
emc	elan_touchpad_driver	*	cpe:2.3:a:emc:elan_touchpad_driver::::::::

CNA Affected

[
  {
    "product": "Lenovo ElanTech Touchpad driver",
    "vendor": "Lenovo Group Ltd.",
    "versions": [
      {
        "status": "affected",
        "version": "various versions"
      }
    ]
  }
]

References

support.lenovo.com/us/en/product_security/LEN-14390

CVSS2

7.2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

7.8

Confidence

High

EPSS

Percentile

5.1%

JSON

Related for CVE-2017-3757