CVE-2017-3752
An industry-wide vulnerability has been identified in the implementation of the Open Shortest Path First (OSPF) routing protocol used on some Lenovo switches.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.44%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
An industry-wide vulnerability has been identified in the implementation of the Open Shortest Path First (OSPF) routing protocol used on some Lenovo switches. Exploitation of these implementation flaws may result in attackers being able to erase or alter the routing tables of one or many routers, switches, or other devices that support OSPF within a routing domain.
- CVSS 3.0
- 8.2 HIGHCVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:H
- EPSS
- 0.44% probability · 37th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-20
- Affected
- ibm/1g l2-7 slb · ibm/1\ · ibm/layer 2\/3 copper firmware · ibm/virtual fabric 10gb · ibm/en2092 1gb firmware · ibm/fabric cn4093 10gb firmware · ibm/fabric en4093\/en4093r 10gb firmware · ibm/g8052 firmware · ibm/g8124 firmware · ibm/g8124e firmware · ibm/g8264 firmware · ibm/g8264cs firmware · ibm/g8264t firmware · ibm/g8316 firmware · ibm/g8332 firmware · lenovo/fabric cn4093 10gb firmware · lenovo/fabric en4093r 10gb firmware · lenovo/si4091 firmware · lenovo/g8052 firmware · lenovo/g8124e firmware · +5 more
- Source
- psirt@lenovo.com
References
- http://www.securityfocus.com/bid/99995Third Party Advisory, VDB Entry
- https://support.lenovo.com/us/en/product_security/LEN-14078Vendor Advisory
- http://www.securityfocus.com/bid/99995Third Party Advisory, VDB Entry
- https://support.lenovo.com/us/en/product_security/LEN-14078Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.