Sensitive information in log files in Lenovo System x IMM2
Priority LOW 30CWE-532Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- No fix listed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-532.
Summary
In the IMM2 firmware of Lenovo System x servers, remote commands issued by LXCA or other utilities may be captured in the First Failure Data Capture (FFDC) service log if the service log is generated when that remote command is running. Captured command data may contain clear text login information. Authorized users that can capture and export FFDC service log data may have access to these remote commands.
Why it matters now
EPSS 0.00842 58th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Lenovo | Lenovo System x IMM2 | Lenovo System x IMM2 firmware versions earlier than 4.10 and IBM System x IMM2 firmware versions earlier than 6.20 | — | No fix listed | CNA |
- Lenovo System x IMM2 VendorLenovo Affected Lenovo System x IMM2 firmware versions earlier than 4.10 and IBM System x IMM2 firmware versions earlier than 6.20 Fixed in — No fix listed CNA
CPE configurations NVD · 47
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:lenovo:integrated_management_module_firmware:*:*:*:*:*:*:*:* | up to 4.9 | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:flex_system_x240_m4:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:h:lenovo:flex_system_x240_m5:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:h:lenovo:flex_system_x280_x6:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:h:lenovo:flex_system_x440_m4:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:h:lenovo:flex_system_x480_x6:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:h:lenovo:flex_system_x880:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:h:lenovo:nextscale_nx360_m5:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:h:lenovo:system_x3250_m6:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:h:lenovo:system_x3500_m5:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
- cpe:2.3:o:lenovo:integrated_management_module_firmware:*:*:*:*:*:*:*:* Versions up to 4.9 Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:flex_system_x240_m4:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:h:lenovo:flex_system_x240_m5:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:h:lenovo:flex_system_x280_x6:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:h:lenovo:flex_system_x440_m4:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:h:lenovo:flex_system_x480_x6:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:h:lenovo:flex_system_x880:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:h:lenovo:nextscale_nx360_m5:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:h:lenovo:system_x3250_m6:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:h:lenovo:system_x3500_m5:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
Show 37 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:h:lenovo:system_x3550_m5:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:h:lenovo:system_x3650_m5:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:h:lenovo:system_x3750_m4:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:h:lenovo:system_x3850_x6:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:h:lenovo:system_x3950_x6:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:h:lenovo:thinkagile_cx2200:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:h:lenovo:thinkagile_cx4200:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:h:lenovo:thinkagile_cx4600:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:o:ibm:integrated_management_module_firmware:*:*:*:*:*:*:*:* | up to 6.19 | Vulnerable | IBM |
| cpe:2.3:h:ibm:bladecenter_hs22:-:*:*:*:*:*:*:* | not specified by NVD | Running on | IBM |
| cpe:2.3:h:ibm:bladecenter_hs23:-:*:*:*:*:*:*:* | not specified by NVD | Running on | IBM |
| cpe:2.3:h:ibm:bladecenter_hs23e:-:*:*:*:*:*:*:* | not specified by NVD | Running on | IBM |
| cpe:2.3:h:ibm:flex_system_x220_m4:-:*:*:*:*:*:*:* | not specified by NVD | Running on | IBM |
| cpe:2.3:h:ibm:flex_system_x222_m4:-:*:*:*:*:*:*:* | not specified by NVD | Running on | IBM |
| cpe:2.3:h:ibm:flex_system_x240_m4:-:*:*:*:*:*:*:* | not specified by NVD | Running on | IBM |
| cpe:2.3:h:ibm:flex_system_x280_m4:-:*:*:*:*:*:*:* | not specified by NVD | Running on | IBM |
| cpe:2.3:h:ibm:flex_system_x440_m4:-:*:*:*:*:*:*:* | not specified by NVD | Running on | IBM |
| cpe:2.3:h:ibm:flex_system_x480_m4:-:*:*:*:*:*:*:* | not specified by NVD | Running on | IBM |
| cpe:2.3:h:ibm:flex_system_x880_m4:-:*:*:*:*:*:*:* | not specified by NVD | Running on | IBM |
| cpe:2.3:h:ibm:idataplex_dx360_m4:-:*:*:*:*:*:*:* | not specified by NVD | Running on | IBM |
| cpe:2.3:h:ibm:idataplex_dx360_m4_water_cooled:-:*:*:*:*:*:*:* | not specified by NVD | Running on | IBM |
| cpe:2.3:h:ibm:nextscale_nx360_m4:-:*:*:*:*:*:*:* | not specified by NVD | Running on | IBM |
| cpe:2.3:h:ibm:system_x3100_m4:-:*:*:*:*:*:*:* | not specified by NVD | Running on | IBM |
| cpe:2.3:h:ibm:system_x3100_m5:-:*:*:*:*:*:*:* | not specified by NVD | Running on | IBM |
| cpe:2.3:h:ibm:system_x3250_m4:-:*:*:*:*:*:*:* | not specified by NVD | Running on | IBM |
| cpe:2.3:h:ibm:system_x3250_m5:-:*:*:*:*:*:*:* | not specified by NVD | Running on | IBM |
| cpe:2.3:h:ibm:system_x3300_m4:-:*:*:*:*:*:*:* | not specified by NVD | Running on | IBM |
| cpe:2.3:h:ibm:system_x3500_m4:-:*:*:*:*:*:*:* | not specified by NVD | Running on | IBM |
| cpe:2.3:h:ibm:system_x3530_m4:-:*:*:*:*:*:*:* | not specified by NVD | Running on | IBM |
| cpe:2.3:h:ibm:system_x3550_m4:-:*:*:*:*:*:*:* | not specified by NVD | Running on | IBM |
| cpe:2.3:h:ibm:system_x3630_m4:-:*:*:*:*:*:*:* | not specified by NVD | Running on | IBM |
| cpe:2.3:h:ibm:system_x3650_m4:-:*:*:*:*:*:*:* | not specified by NVD | Running on | IBM |
| cpe:2.3:h:ibm:system_x3650_m4_bd:-:*:*:*:*:*:*:* | not specified by NVD | Running on | IBM |
| cpe:2.3:h:ibm:system_x3650_m4_hd:-:*:*:*:*:*:*:* | not specified by NVD | Running on | IBM |
| cpe:2.3:h:ibm:system_x3750_m4:-:*:*:*:*:*:*:* | not specified by NVD | Running on | IBM |
| cpe:2.3:h:ibm:system_x3850_x6:-:*:*:*:*:*:*:* | not specified by NVD | Running on | IBM |
| cpe:2.3:h:ibm:system_x3950_x6:-:*:*:*:*:*:*:* | not specified by NVD | Running on | IBM |
- cpe:2.3:h:lenovo:system_x3550_m5:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:h:lenovo:system_x3650_m5:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:h:lenovo:system_x3750_m4:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:h:lenovo:system_x3850_x6:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:h:lenovo:system_x3950_x6:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:h:lenovo:thinkagile_cx2200:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:h:lenovo:thinkagile_cx4200:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:h:lenovo:thinkagile_cx4600:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:o:ibm:integrated_management_module_firmware:*:*:*:*:*:*:*:* Versions up to 6.19 Vulnerable ·IBM
- cpe:2.3:h:ibm:bladecenter_hs22:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·IBM
- cpe:2.3:h:ibm:bladecenter_hs23:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·IBM
- cpe:2.3:h:ibm:bladecenter_hs23e:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·IBM
- cpe:2.3:h:ibm:flex_system_x220_m4:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·IBM
- cpe:2.3:h:ibm:flex_system_x222_m4:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·IBM
- cpe:2.3:h:ibm:flex_system_x240_m4:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·IBM
- cpe:2.3:h:ibm:flex_system_x280_m4:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·IBM
- cpe:2.3:h:ibm:flex_system_x440_m4:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·IBM
- cpe:2.3:h:ibm:flex_system_x480_m4:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·IBM
- cpe:2.3:h:ibm:flex_system_x880_m4:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·IBM
- cpe:2.3:h:ibm:idataplex_dx360_m4:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·IBM
- cpe:2.3:h:ibm:idataplex_dx360_m4_water_cooled:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·IBM
- cpe:2.3:h:ibm:nextscale_nx360_m4:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·IBM
- cpe:2.3:h:ibm:system_x3100_m4:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·IBM
- cpe:2.3:h:ibm:system_x3100_m5:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·IBM
- cpe:2.3:h:ibm:system_x3250_m4:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·IBM
- cpe:2.3:h:ibm:system_x3250_m5:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·IBM
- cpe:2.3:h:ibm:system_x3300_m4:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·IBM
- cpe:2.3:h:ibm:system_x3500_m4:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·IBM
- cpe:2.3:h:ibm:system_x3530_m4:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·IBM
- cpe:2.3:h:ibm:system_x3550_m4:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·IBM
- cpe:2.3:h:ibm:system_x3630_m4:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·IBM
- cpe:2.3:h:ibm:system_x3650_m4:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·IBM
- cpe:2.3:h:ibm:system_x3650_m4_bd:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·IBM
- cpe:2.3:h:ibm:system_x3650_m4_hd:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·IBM
- cpe:2.3:h:ibm:system_x3750_m4:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·IBM
- cpe:2.3:h:ibm:system_x3850_x6:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·IBM
- cpe:2.3:h:ibm:system_x3950_x6:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·IBM
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2017-3744
- 2026-10-03 Alias added: GHSA-vwcj-7f4r-r8xj
References
Sources
- CVE-2017-3744 · CVE Program
- CVE-2017-3744 · NVD
- FIRST EPSS
- GHSA-vwcj-7f4r-r8xj · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences