VIR Vulnerability Intelligence Relay

CVE-2017-3761

critical
Published 2017-10-17 · Modified 2026-05-13
CVSS v3
9.8
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v2
10.0
VIR risk
9.8

Description

The Lenovo Service Framework Android application executes some system commands without proper sanitization of external input. In certain cases, this could lead to command injection which, in turn, could lead to remote code execution.

Predictions

Exploit likelihood
97%
Patch ETA
—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

vendor Authored 2026-05-27

Vendor advisory: psirt@lenovo.com — https://support.lenovo.com/us/en/product_security/LEN-15374

Application impact
VendorProductVersionsFixed
lenovoservice_framework-

References

CWEs

CWE-78

Verify integrity in audit chain (admin only). AS-IS.