CVE-2017-3774

Severity: critical (CVSS 9.8 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2018-04-19 · updated 2026-06-17
Weakness: CWE-119

Description

A stack overflow vulnerability was discovered within the web administration service in Integrated Management Module 2 (IMM2) earlier than version 4.70 used in some Lenovo servers and earlier than version 6.60 used in some IBM servers. An attacker providing a crafted user ID and password combination can cause a portion of the authentication routine to overflow its stack, resulting in stack corruption.

Affected products

Lenovo Integrated Management Module 2: before 4.70; before 6.60 — fixed in 4.70, 6.60

How to fix

Upgrade to a fixed version: Lenovo Integrated Management Module 2 4.70, 6.60. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2017-3774 or the next vulnerability affects your stack