CVE-2017-3768: ibm bladecenter_hs22_firmware Uncontrolled Resource Consumption
Vulnerability summary
CVE-2017-3768 is a high (CVSS 7.8) Uncontrolled Resource Consumption vulnerability in ibm bladecenter_hs22_firmware. EPSS estimates a 1.21% chance of exploitation in the next 30 days, higher than 68% of scored vulnerabilities.
Timeline
- 26-01-2018PublishedVulnerability first disclosed.
- 16-09-2024Last modifiedVulnerability information updated.
Description
An unprivileged attacker with connectivity to the IMM2 could cause a denial of service attack on the IMM2 (Versions earlier than 4.4 for Lenovo System x and earlier than 6.4 for IBM System x). Flooding the IMM2 with a high volume of authentication failures via the Common Information Model (CIM) used by LXCA and OneCLI and other tools can exhaust available system memory which can cause the IMM2 to reboot itself until the requests cease.
CVSS metrics
2 scores · 1 source · 2 versionsEPSS trend
Probability
1.21%
Chance of exploitation in the next 30 days
Percentile
68%
Versus all other CVEs
30-day change
0.00 pp
From 1.21% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Ibm28 products
- bladecenter_hs22_firmware< 6.4
- bladecenter_hs23_firmware< 6.4
- bladecenter_hs23e_firmware< 6.4
- flex_system_x220_m4_firmware< 6.4
- flex_system_x222_m4_firmware< 6.4
Lenova14 products
- flex_system_x240_m4_firmware< 4.4
- flex_system_x240_m5_firmware< 4.4
- flex_system_x280_x6_firmware< 4.4
- flex_system_x440_m4_firmware< 4.4
- flex_system_x480_x6_firmware< 4.4
Lenovo group ltd.1 product
- integrated management module 2 (imm2)Earlier than 4.4 for Lenovo System x | Earlier than 6.4 for IBM System x
3 vendors · 43 products