CVE-2017-3743

7.5 highEPSS 0.7%

If multiple users are concurrently logged into a single system where one user is sending a command via the Lenovo ToolsCenter Advanced Settings Utility (ASU), UpdateXpress System Pack Installer (UXSPI) or Dynamic System Analysis (DSA) to a second machine, the other users may be able to see the user ID and clear text password that were used to access the second machine during the time the command is processing.

Severity

CVSS 3.0

7.5 high

CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.7% chance of exploitation in the next 30 days; higher than 54% of CVEs (scores of 2026-10-31)
CWE: CWE-200
Published: 2017-06-20
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

lenovo:advanced_settings_utility
lenovo:toolscenter_dynamic_system_analysis
lenovo:updatexpress_system_pack_installer

References

https://support.lenovo.com/us/en/product_security/LEN-10810
https://support.lenovo.com/us/en/product_security/LEN-10810

Check your stack JSON