In the IMM2 firmware of Lenovo System x servers, remote commands issued by LXCA or other utilities may be captured in the First Failure Data Capture (FFDC) service log if the service log is generated when that remote command is running. Captured command data may contain clear text login information. Authorized users that can capture and export FFDC service log data may have access to these remote commands.

No CVSS v4.0

No CVSS v3.1

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

Access Vector Network

Access Complexity Low

Authentication Single

Confidentiality Impact Partial

Integrity Impact None

Availability Impact None

This CVE is not in the KEV list.

The EPSS score is 0.00264.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
Lenovo Group Ltd. Lenovo System x IMM2 affected
Version Status Constraints
Lenovo System x IMM2 firmware versions earlier than 4.10 and IBM System x IMM2 firmware versions earlier than 6.20 affected —

Configuration 1 [-]

AND
cpe:2.3:o:lenovo:integrated_management_module_firmware:*:*:*:*:*:*:*:*
OR cpe:2.3:h:lenovo:flex_system_x240_m4:-:*:*:*:*:*:*:*
cpe:2.3:h:lenovo:flex_system_x240_m5:-:*:*:*:*:*:*:*
cpe:2.3:h:lenovo:flex_system_x280_x6:-:*:*:*:*:*:*:*
cpe:2.3:h:lenovo:flex_system_x440_m4:-:*:*:*:*:*:*:*
cpe:2.3:h:lenovo:flex_system_x480_x6:-:*:*:*:*:*:*:*
cpe:2.3:h:lenovo:flex_system_x880:-:*:*:*:*:*:*:*
cpe:2.3:h:lenovo:nextscale_nx360_m5:-:*:*:*:*:*:*:*
cpe:2.3:h:lenovo:system_x3250_m6:-:*:*:*:*:*:*:*
cpe:2.3:h:lenovo:system_x3500_m5:-:*:*:*:*:*:*:*
cpe:2.3:h:lenovo:system_x3550_m5:-:*:*:*:*:*:*:*
cpe:2.3:h:lenovo:system_x3650_m5:-:*:*:*:*:*:*:*
cpe:2.3:h:lenovo:system_x3750_m4:-:*:*:*:*:*:*:*
cpe:2.3:h:lenovo:system_x3850_x6:-:*:*:*:*:*:*:*
cpe:2.3:h:lenovo:system_x3950_x6:-:*:*:*:*:*:*:*
cpe:2.3:h:lenovo:thinkagile_cx2200:-:*:*:*:*:*:*:*
cpe:2.3:h:lenovo:thinkagile_cx4200:-:*:*:*:*:*:*:*
cpe:2.3:h:lenovo:thinkagile_cx4600:-:*:*:*:*:*:*:*

Configuration 2 [-]

AND
cpe:2.3:o:ibm:integrated_management_module_firmware:*:*:*:*:*:*:*:*
OR cpe:2.3:h:ibm:bladecenter_hs22:-:*:*:*:*:*:*:*
cpe:2.3:h:ibm:bladecenter_hs23:-:*:*:*:*:*:*:*
cpe:2.3:h:ibm:bladecenter_hs23e:-:*:*:*:*:*:*:*
cpe:2.3:h:ibm:flex_system_x220_m4:-:*:*:*:*:*:*:*
cpe:2.3:h:ibm:flex_system_x222_m4:-:*:*:*:*:*:*:*
cpe:2.3:h:ibm:flex_system_x240_m4:-:*:*:*:*:*:*:*
cpe:2.3:h:ibm:flex_system_x280_m4:-:*:*:*:*:*:*:*
cpe:2.3:h:ibm:flex_system_x440_m4:-:*:*:*:*:*:*:*
cpe:2.3:h:ibm:flex_system_x480_m4:-:*:*:*:*:*:*:*
cpe:2.3:h:ibm:flex_system_x880_m4:-:*:*:*:*:*:*:*
cpe:2.3:h:ibm:idataplex_dx360_m4:-:*:*:*:*:*:*:*
cpe:2.3:h:ibm:idataplex_dx360_m4_water_cooled:-:*:*:*:*:*:*:*
cpe:2.3:h:ibm:nextscale_nx360_m4:-:*:*:*:*:*:*:*
cpe:2.3:h:ibm:system_x3100_m4:-:*:*:*:*:*:*:*
cpe:2.3:h:ibm:system_x3100_m5:-:*:*:*:*:*:*:*
cpe:2.3:h:ibm:system_x3250_m4:-:*:*:*:*:*:*:*
cpe:2.3:h:ibm:system_x3250_m5:-:*:*:*:*:*:*:*
cpe:2.3:h:ibm:system_x3300_m4:-:*:*:*:*:*:*:*
cpe:2.3:h:ibm:system_x3500_m4:-:*:*:*:*:*:*:*
cpe:2.3:h:ibm:system_x3530_m4:-:*:*:*:*:*:*:*
cpe:2.3:h:ibm:system_x3550_m4:-:*:*:*:*:*:*:*
cpe:2.3:h:ibm:system_x3630_m4:-:*:*:*:*:*:*:*
cpe:2.3:h:ibm:system_x3650_m4:-:*:*:*:*:*:*:*
cpe:2.3:h:ibm:system_x3650_m4_bd:-:*:*:*:*:*:*:*
cpe:2.3:h:ibm:system_x3650_m4_hd:-:*:*:*:*:*:*:*
cpe:2.3:h:ibm:system_x3750_m4:-:*:*:*:*:*:*:*
cpe:2.3:h:ibm:system_x3850_x6:-:*:*:*:*:*:*:*
cpe:2.3:h:ibm:system_x3950_x6:-:*:*:*:*:*:*:*

No data.

No data.

Project Subscriptions

Vendors Products
Ibm Subscribe
Bladecenter Hs22 Subscribe
Bladecenter Hs23 Subscribe
Bladecenter Hs23e Subscribe
Flex System X220 M4 Subscribe
Flex System X222 M4 Subscribe
Flex System X240 M4 Subscribe
Flex System X280 M4 Subscribe
Flex System X440 M4 Subscribe
Flex System X480 M4 Subscribe
Flex System X880 M4 Subscribe
Idataplex Dx360 M4 Subscribe
Idataplex Dx360 M4 Water Cooled Subscribe
Integrated Management Module Firmware Subscribe
Nextscale Nx360 M4 Subscribe
System X3100 M4 Subscribe
System X3100 M5 Subscribe
System X3250 M4 Subscribe
System X3250 M5 Subscribe
System X3300 M4 Subscribe
System X3500 M4 Subscribe
System X3530 M4 Subscribe
System X3550 M4 Subscribe
System X3630 M4 Subscribe
System X3650 M4 Subscribe
System X3650 M4 Bd Subscribe
System X3650 M4 Hd Subscribe
System X3750 M4 Subscribe
System X3850 X6 Subscribe
System X3950 X6 Subscribe
Lenovo Subscribe
Flex System X240 M4 Subscribe
Flex System X240 M5 Subscribe
Flex System X280 X6 Subscribe
Flex System X440 M4 Subscribe
Flex System X480 X6 Subscribe
Flex System X880 Subscribe
Integrated Management Module Firmware Subscribe
Nextscale Nx360 M5 Subscribe
System X3250 M6 Subscribe
System X3500 M5 Subscribe
System X3550 M5 Subscribe
System X3650 M5 Subscribe
System X3750 M4 Subscribe
System X3850 X6 Subscribe
System X3950 X6 Subscribe
Thinkagile Cx2200 Subscribe
Thinkagile Cx4200 Subscribe
Thinkagile Cx4600 Subscribe
Advisories
Source ID Title
EUVD EUVD EUVD-2017-12861 In the IMM2 firmware of Lenovo System x servers, remote commands issued by LXCA or other utilities may be captured in the First Failure Data Capture (FFDC) service log if the service log is generated when that remote command is running. Captured command data may contain clear text login information. Authorized users that can capture and export FFDC service log data may have access to these remote commands.
Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://support.lenovo.com/product_security/LEN-14054 cve-icon cve-icon
History

No history.

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: lenovo

Published:

Updated: 2024-08-05T14:39:41.051Z

Reserved: 2016-12-16T00:00:00.000Z

Link: CVE-2017-3744

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Deferred

Published: 2017-06-20T00:29:00.330

Modified: 2025-04-20T01:37:25.860

Link: CVE-2017-3744

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses