Skip to content
Fencer Vulns
high 7.5

CVE-2017-3768 json

An unprivileged attacker with connectivity to the IMM2 could cause a denial of service attack on the IMM2 (Versions earlier than 4.4 for Le…

published 2018-01-26 8 y ago modified 2026-06-17 4 mo ago also EUVD-2017-12885

cvss
7.5
version 3.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
1.2%
EPSS 1.2% chance of exploitation in 30 days, percentile 68%
public exploits
0
none known

Summary

An unprivileged attacker with connectivity to the IMM2 could cause a denial of service attack on the IMM2 (Versions earlier than 4.4 for Lenovo System x and earlier than 6.4 for IBM System x). Flooding the IMM2 with a high volume of authentication failures via the Common Information Model (CIM) used by LXCA and OneCLI and other tools can exhaust available system memory which can cause the IMM2 to reboot itself until the requests cease.

Patch / fix

  • lenova flex_system_x240_m5_firmware 4.4
  • lenova flex_system_x280_x6_firmware 4.4
  • lenova flex_system_x440_m4_firmware 4.4
  • lenova flex_system_x480_x6_firmware 4.4
  • lenova flex_system_x880_firmware 4.4
  • lenova nextscale_nx360_m5_firmware 4.4
  • lenova system_x3250_m6_firmware 4.4
  • lenova system_x3500_m5_firmware 4.4
  • lenova system_x3550_m5_firmware 4.4
  • lenova system_x3650_m5_firmware 4.4
  • lenova system_x3750_m4_firmware 4.4
  • lenova system_x3850_x6_firmware 4.4
  • lenova system_x3950_x6_firmware 4.4
  • lenova flex_system_x240_m4_firmware 4.4
  • ibm bladecenter_hs22_firmware 6.4
  • ibm bladecenter_hs23_firmware 6.4
  • ibm bladecenter_hs23e_firmware 6.4
  • ibm flex_system_x220_m4_firmware 6.4
  • ibm flex_system_x222_m4_firmware 6.4
  • ibm flex_system_x240_m4_firmware 6.4

Exploit prediction

1.21% chance of exploitation in the next 30 days, higher than 68% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
NVD 3.0 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD 2.0 7.8 AV:N/AC:L/Au:N/C:N/I:N/A:C

Affected products

  • Lenovo Group Ltd. Integrated Management Module 2 (IMM2)

Classification

Weakness
  • CWE-400 Uncontrolled Resource Consumption

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.