CVE-2017-3748: On Lenovo VIBE mobile phones, improper access controls on the nac_server component can be abused in conjunc...

Security readout for executives and security teams

This issue affects older Lenovo VIBE and China-only Moto mobile phones running software earlier than 6.0. A weak access-control design in the nac_server component could contribute to rooting the device when combined with two related Lenovo CVEs. Public sources do not provide CVSS scoring or active exploitation evidence. Exposure appears limited to legacy Lenovo VIBE and China-only Moto mobile devices running versions earlier than 6.0. Organizations without these devices, or without managed BYOD exposure to them, are unlikely to be directly affected based on the provided sources. Treat this as a legacy mobile-device risk, not a broad infrastructure emergency. Prioritize discovery and removal or restriction of affected phones, especially where they can access corporate email, VPN, identity apps, or sensitive data. Mitigation focus: Inventory managed and BYOD Lenovo VIBE and China-only Moto devices.; Identify devices running software versions earlier than 6.0.; Check Lenovo advisory LEN-15823 for vendor-approved remediation guidance..

Prepared

Jun 13, 2026, 04:43 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.