ThinkPad USB 3.0 Ethernet Adapter Driver Privilege Escalation - us

Lenovo Security Advisory: LEN-9896

Potential Impact: Privilege escalation and executable files without a valid signature

Severity: High

**Scope of Impact:**Lenovo Specific

**CVE Identifier:**CVE-2017-3746

Summary Description:

During an internal analysis, the ThinkPad USB 3.0 Ethernet Adapter (part number 4X90E51405) driver was found to contain a privilege escalation vulnerability that could allow a local user to execute arbitrary code with administrative or system level privileges.

The ThinkPad USB 3.0 Ethernet (4X90E51405) adapter enables Ethernet through the USB port on systems that do not come with an Ethernet RJ-45 connector.

Mitigation Strategy for Customers (what you should do to protect yourself):

Update to the latest version of the USB 3.0 Ethernet Adapter driver by following the link here.

Windows 7 (32bit & 64bit) version: 7.30. 321.2017
Windows 8 (32bit & 64bit) version: 8.37. 321.2017
Windows 8.1 (32bit & 64bit) version: 8.37. 321.2017
Windows 10 (64bit) version: 10.16.321.2017

For a complete list of all Lenovo Product Security Advisories, click here.

Revision History:

Revision

|

Date

|

Description

—|—|—

1

|

08/24/2017

|

Initial release

For the most up to date information, please remain current with updates and advisories from Lenovo regarding your equipment and software. The information provided in this advisory is provided on as “as is” basis without any warranty or guarantee of any kind. Lenovo reserves the right to change or update this advisory at any time.