Read the docs
TI-2017-02863 Aliases CVE-2017-3748GHSA-g7gx-c2jg-7cg5

On Lenovo VIBE mobile phones, improper access controls on the nac_server component can be…

Priority LOW 33Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA.

Summary

On Lenovo VIBE mobile phones, improper access controls on the nac_server component can be abused in conjunction with CVE-2017-3749 and CVE-2017-3750 to elevate privileges to the root user (commonly known as 'rooting' or "jail breaking" a device).

Why it matters now

EPSS 0.00176 7th percentileScored 2026-11-07
Fix Fixed Lenovo Vibe and Lenovo China-only Moto Mobile Phones (Lenovo Group Ltd.): 6.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
LenovoLenovo Vibe and Lenovo China-only Moto Mobile Phonesbefore 6.06.0Patch availableCNA
  • Lenovo Vibe and Lenovo China-only Moto Mobile Phones VendorLenovo Affected before 6.0 Fixed in 6.0 Patch available CNA

CPE configurations NVD · 21

CPEVersionsRoleVendor
cpe:2.3:o:google:android:*:*:*:*:*:*:*:*up to 5.1.1VulnerableGoogle
cpe:2.3:h:lenovo:vibe_a1600:-:*:*:*:*:*:*:*not specified by NVDRunning onLenovo
cpe:2.3:h:lenovo:vibe_a2560:-:*:*:*:*:*:*:*not specified by NVDRunning onLenovo
cpe:2.3:h:lenovo:vibe_a2800:-:*:*:*:*:*:*:*not specified by NVDRunning onLenovo
cpe:2.3:h:lenovo:vibe_a2860:-:*:*:*:*:*:*:*not specified by NVDRunning onLenovo
cpe:2.3:h:lenovo:vibe_a2880:-:*:*:*:*:*:*:*not specified by NVDRunning onLenovo
cpe:2.3:h:lenovo:vibe_a3000:-:*:*:*:*:*:*:*not specified by NVDRunning onLenovo
cpe:2.3:h:lenovo:vibe_a3500:-:*:*:*:*:*:*:*not specified by NVDRunning onLenovo
cpe:2.3:h:lenovo:vibe_a3600-d:-:*:*:*:*:*:*:*not specified by NVDRunning onLenovo
cpe:2.3:h:lenovo:vibe_a3600u:-:*:*:*:*:*:*:*not specified by NVDRunning onLenovo
  • cpe:2.3:o:google:android:*:*:*:*:*:*:*:* Versions up to 5.1.1 Vulnerable ·Google
  • cpe:2.3:h:lenovo:vibe_a1600:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
  • cpe:2.3:h:lenovo:vibe_a2560:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
  • cpe:2.3:h:lenovo:vibe_a2800:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
  • cpe:2.3:h:lenovo:vibe_a2860:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
  • cpe:2.3:h:lenovo:vibe_a2880:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
  • cpe:2.3:h:lenovo:vibe_a3000:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
  • cpe:2.3:h:lenovo:vibe_a3500:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
  • cpe:2.3:h:lenovo:vibe_a3600-d:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
  • cpe:2.3:h:lenovo:vibe_a3600u:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
Show 11 more CPE
CPEVersionsRoleVendor
cpe:2.3:h:lenovo:vibe_a3800-d:-:*:*:*:*:*:*:*not specified by NVDRunning onLenovo
cpe:2.3:h:lenovo:vibe_a3900:-:*:*:*:*:*:*:*not specified by NVDRunning onLenovo
cpe:2.3:h:lenovo:vibe_a6000:-:*:*:*:*:*:*:*not specified by NVDRunning onLenovo
cpe:2.3:h:lenovo:vibe_a6000-i:-:*:*:*:*:*:*:*not specified by NVDRunning onLenovo
cpe:2.3:h:lenovo:vibe_a6020i37:-:*:*:*:*:*:*:*not specified by NVDRunning onLenovo
cpe:2.3:h:lenovo:vibe_a6600:-:*:*:*:*:*:*:*not specified by NVDRunning onLenovo
cpe:2.3:h:lenovo:vibe_a6800:-:*:*:*:*:*:*:*not specified by NVDRunning onLenovo
cpe:2.3:h:lenovo:vibe_k30-e:-:*:*:*:*:*:*:*not specified by NVDRunning onLenovo
cpe:2.3:h:lenovo:vibe_k30-w-cu:-:*:*:*:*:*:*:*not specified by NVDRunning onLenovo
cpe:2.3:h:lenovo:vibe_k32c30:-:*:*:*:*:*:*:*not specified by NVDRunning onLenovo
cpe:2.3:h:lenovo:vibe_k80m:-:*:*:*:*:*:*:*not specified by NVDRunning onLenovo
  • cpe:2.3:h:lenovo:vibe_a3800-d:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
  • cpe:2.3:h:lenovo:vibe_a3900:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
  • cpe:2.3:h:lenovo:vibe_a6000:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
  • cpe:2.3:h:lenovo:vibe_a6000-i:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
  • cpe:2.3:h:lenovo:vibe_a6020i37:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
  • cpe:2.3:h:lenovo:vibe_a6600:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
  • cpe:2.3:h:lenovo:vibe_a6800:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
  • cpe:2.3:h:lenovo:vibe_k30-e:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
  • cpe:2.3:h:lenovo:vibe_k30-w-cu:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
  • cpe:2.3:h:lenovo:vibe_k32c30:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
  • cpe:2.3:h:lenovo:vibe_k80m:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo

Remediation

  • Fix · CNA Lenovo Vibe and Lenovo China-only Moto Mobile Phones (Lenovo Group Ltd.) Fixed in 6.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2017-3748
  2. 2026-10-03 Alias added: GHSA-g7gx-c2jg-7cg5

References

Advisory 1

  • TI-2017-03639 Improper handling of exceptional conditions in Apache Struts KEVCVSS 3.1CRITICAL 9.8
  • TI-2024-07516 Insecure Platform Key (PK) used in UEFI system firmware signature CVSS 3.1MEDIUM 6.4
  • TI-2017-13070 OpenSLP releases in the 1.0.2 and 1.1.0 code streams have a heap-related memory… CVSS 3.0CRITICAL 9.8
  • TI-2017-02875 OS command injection in Lenovo Service Framework application CVSS 3.0CRITICAL 9.8
  • TI-2013-01192 Untrusted search path vulnerability in Lenovo Thinkpad Bluetooth with Enhanced Data Rate… CVSS 2.0HIGH 9.3
  • TI-2026-53163 Hard-coded credentials in Lenovo Health Application CVSS 4.0CRITICAL 9.3
See all 534 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences