Is CVE-2017-3753 actively exploited?

No active exploitation of CVE-2017-3753 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2017-3753 be exploited remotely?

No. CVE-2017-3753 requires physical access to exploit.

What is the CVSS score of CVE-2017-3753?

CVE-2017-3753 has a CVSS score of 6.8 (MEDIUM).

HOME VULNERABILITIESCVE-2017-3753

MEDIUM

CVE-2017-3753

CWE-94Published: August 10, 2017· Updated: Jun 17, 2026

6.8

CVSS v3.1

Official Description

A vulnerability has been identified in some Lenovo products that use UEFI (BIOS) code developed by American Megatrends, Inc. (AMI). With this vulnerability, conditions exist where an attacker with administrative privileges or physical access to a system may be able to run specially crafted code that can allow them to bypass system protections such as Device Guard and Hyper-V.

NVD Source

Technical Analysis

CVE-2017-3753 requires local access, meaning attackers must already have a foothold on the target system.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.

A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), availability disruption (denial of service), with a CVSS base score of 6.8.

CVSS v3.1 Vector Breakdown

Exploitability

Attack VectorPhysical

Attack ComplexityLow

Privileges Req.None

User InteractionNone

ScopeUnchanged

Impact

ConfidentialityHigh

IntegrityHigh

AvailabilityHigh

CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected Vendors & Products

Lenovo219 product(s)

ideacentre 300-20ish firmwareideacentre 300-20ishideacentre 300s-11ish firmwareideacentre 300s-11ishideacentre 510s-08ish firmwareideacentre 510s-08ishideacentre 700 firmwareideacentre 70063 firmware63h50-30g firmwareh50-30g+207

Source: NVD CPE · 219 total CPE entries