CVE-2017-3742

MediumCVSS 4.8/10Last modified Jun 17, 2026

Description

In Lenovo Connect2 versions earlier than 4.2.5.4885 for Windows and 4.2.5.3071 for Android, when an ad-hoc connection is made between two systems for the purpose of sharing files, the password for this ad-hoc connection will be stored in a user-readable location. An attacker with read access to the user's contents could connect to the Connect2 hotspot and see the contents of files while they are being transferred between the two systems.

Metrics

CVSS 3.0 4.8/10CVSS:3.0/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-200

Affected software

No affected versions have been published.

Timeline

Published: Jul 17, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-37437.5If multiple users are concurrently logged into a single system where one user is sending a command via the Lenovo ToolsCenter Advanced Setti CVE-2017-37446.5In the IMM2 firmware of Lenovo System x servers, remote commands issued by LXCA or other utilities may be captured in the First Failure Data CVE-2017-37457.8In Lenovo XClarity Administrator (LXCA) before 1.3.0, if service data is downloaded from LXCA, a non-administrative user may have access to CVE-2017-37467.8ThinkPad USB 3.0 Ethernet Adapter (part number 4X90E51405) driver, various versions, was found to contain a privilege escalation vulnerabili CVE-2017-37475.5Privilege escalation vulnerability in Lenovo Nerve Center for Windows 10 on Desktop systems (Lenovo Nerve Center for notebook systems is not CVE-2017-37487.8On Lenovo VIBE mobile phones, improper access controls on the nac_server component can be abused in conjunction with CVE-2017-3749 and CVE-2 CVE-2017-37496.4On Lenovo VIBE mobile phones, the Idea Friend Android application allows private data to be backed up and restored via Android Debug Bridge,CVE-2017-37506.4On Lenovo VIBE mobile phones, the Lenovo Security Android application allows private data to be backed up and restored via Android Debug Bri CVE-2017-37517.8An unquoted service path vulnerability was identified in the driver for the ThinkPad Compact USB Keyboard with TrackPoint versions earlier t CVE-2017-37528.2An industry-wide vulnerability has been identified in the implementation of the Open Shortest Path First (OSPF) routing protocol used on som CVE-2017-37536.8A vulnerability has been identified in some Lenovo products that use UEFI (BIOS) code developed by American Megatrends, Inc. (AMI). With thi CVE-2017-37546.7Some Lenovo brand notebook systems do not have write protections properly configured in the system BIOS. This could enable an attacker with