Back to feed
EUVD-2017-12861 · Published Jun 20, 2017
In the IMM2 firmware of Lenovo System x servers, remote commands issued by LXCA or other utilities may be captured in the First Failure Data Capture (FFDC) service log if the service log is generated when that remote command is running. Captured command data may contain clear text login information. Authorized users that can capture and export FFDC service log data may have access to these remote commands.
Technologies
Lenovo System X3550 M5Lenovo Flex System X480 X6Lenovo System X3850 X6Ibm Bladecenter Hs23Ibm Bladecenter Hs22Ibm Flex System X240 M4Lenovo System X3250 M6Ibm System X3530 M4Ibm Nextscale Nx360 M4Ibm Flex System X220 M4Lenovo Flex System X440 M4Ibm Flex System X880 M4Lenovo Thinkagile Cx4200Ibm System X3750 M4Ibm System X3300 M4Ibm System X3650 M4 BdLenovo System X3650 M5Ibm System X3250 M4Ibm Idataplex Dx360 M4Ibm System X3630 M4Lenovo Flex System X280 X6Ibm Flex System X280 M4Ibm System X3100 M4Ibm Flex System X222 M4Ibm System X3500 M4Lenovo Flex System X240 M4Ibm System X3250 M5Ibm Idataplex Dx360 M4 Water CooledIbm System X3550 M4Lenovo Flex System X240 M5Lenovo System X3750 M4Ibm System X3950 X6Lenovo System X3950 X6Ibm System X3650 M4 HdLenovo Flex System X880Ibm Bladecenter Hs23ELenovo Thinkagile Cx4600Ibm System X3650 M4Ibm System X3100 M5Ibm System X3850 X6Ibm Flex System X440 M4Lenovo Nextscale Nx360 M5Lenovo Integrated Management Module FirmwareLenovo Thinkagile Cx2200Ibm Integrated Management Module FirmwareIbm Flex System X480 M4Lenovo System X3500 M5
Weaknesses
CWE-532
CVSS scores
- v3.06.5
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - v2.04.0
AV:N/AC:L/Au:S/C:P/I:N/A:N
MITRE ATT&CK
InferredWhere this vulnerability fits in an attack
Initial Access
References
Potentially impacted assets
See if this affects your attack surface
