CVE-2017-3744

MEDIUM

Lenovo IMM2 Firmware < 4.9 - Sensitive Information Disclosure in FFDC Service Log

Title source: llm
STIX 2.1

Description

In the IMM2 firmware of Lenovo System x servers, remote commands issued by LXCA or other utilities may be captured in the First Failure Data Capture (FFDC) service log if the service log is generated when that remote command is running. Captured command data may contain clear text login information. Authorized users that can capture and export FFDC service log data may have access to these remote commands.

References (1)

Core 1
Core References
Vendor Advisory x_refsource_confirm
https://support.lenovo.com/product_security/LEN-14054

Scores

CVSS v3 6.5
EPSS 0.0026
EPSS Percentile 49.9%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Details

CWE
CWE-532
Status published
Products (3)
ibm/integrated_management_module_firmware < 6.19
lenovo/integrated_management_module_firmware < 4.9
Lenovo Group Ltd./Lenovo System x IMM2 Lenovo System x IMM2 firmware versions earlier than 4.10 and IBM System x IMM2 firmware versions ear
Published Jun 20, 2017
Tracked Since Feb 18, 2026