PT-2015-6149 · Lenovo · Lenovo Thinkserver Rd650+3

Published 2015-04-16 · Updated 2017-01-18 · CVE-2015-3322

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Lenovo ThinkServer RD350, RD450, RD550, RD650, and TD350 servers versions prior to 1.26.0

Description The issue concerns the use of weak encryption to store user and administrator BIOS passwords. This weakness allows attackers to decrypt the passwords, potentially leading to unauthorized access. The exact vectors used for the decryption are not specified.

Recommendations For versions prior to 1.26.0, update to version 1.26.0 or later to resolve the issue with weak encryption of BIOS passwords.

Fix

Weakness Enumeration

CWE-310

Related Identifiers

CVE-2015-3322

Affected Products

Lenovo Thinkserver Rd350

Lenovo Thinkserver Rd450

Lenovo Thinkserver Rd550

Lenovo Thinkserver Rd650

References · 3

• https://support.lenovo.com/us/en/product_security/ts_bios_pw · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-3322 · Security Note
• http://securityfocus.com/bid/74198 · Note