CVE-2017-3744: IBM Integrated Management Module Firmware

Medium severity, CVSS 6.5. EPSS: 0.8% chance of exploitation in the next 30 days.

In the IMM2 firmware of Lenovo System x servers, remote commands issued by LXCA or other utilities may be captured in the First Failure Data Capture (FFDC) service log if the service log is generated when that remote command is running. Captured command data may contain clear text login information. Authorized users that can capture and export FFDC service log data may have access to these remote commands.

Affected products

• IBM Integrated Management Module Firmware: up to and including 6.19
• Lenovo Integrated Management Module Firmware: up to and including 4.9

Published 2017-06-20. Last modified 2026-06-17.