CVE-2017-3756 json
A privilege escalation vulnerability was identified in Lenovo Active Protection System for ThinkPad systems versions earlier than 1.82.0.17.
published 2017-08-18 9 y ago modified 2026-06-17 4 mo ago also EUVD-2017-12873
- cvss
- 7.8
- version 3.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.4%
- EPSS 0.4% chance of exploitation in 30 days, percentile 31%
- public exploits
- 0
- none known
Summary
A privilege escalation vulnerability was identified in Lenovo Active Protection System for ThinkPad systems versions earlier than 1.82.0.17. An attacker with local privileges could execute code with administrative privileges via an unquoted service path.
Exploit prediction
0.38% chance of exploitation in the next 30 days, higher than 31% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.0 | 7.8 | CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 7.2 | AV:L/AC:L/Au:N/C:C/I:C/A:C |
Affected products
- Lenovo Group Ltd. ThinkPad Active Protection System
References
-
support.lenovo.com
/us/en/product_security/LEN-15765
vendor-advisory
-
securityfocus.com
/bid/100305
vdb-entry, third-party-advisory
Sources
- CVE List CVE-2017-3756
- NVD CVE-2017-3756
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.