CVE-2017-3762

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

Sensitive data stored by Lenovo Fingerprint Manager Pro, version 8.01.86 and earlier, including users' Windows logon credentials and fingerprint data, is encrypted using a weak algorithm, contains a hard-coded password, and is accessible to all users with local non-administrative access to the system in which it is installed.

Metrics

CVSS 3.0 7.8/10CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-798

Affected software

Vendor	Product	Versions
Lenovo Group Ltd.	Lenovo Fingerprint Manager Pro	Earlier than 8.01.87

References

http://www.openwall.com/lists/oss-security/2019/05/08/3
http://www.openwall.com/lists/oss-security/2019/05/08/4
http://www.openwall.com/lists/oss-security/2019/05/08/5
http://www.securityfocus.com/bid/102837Third Party Advisory, VDB Entry
https://support.lenovo.com/product_security/LEN-15999Patch, Vendor Advisory
http://www.openwall.com/lists/oss-security/2019/05/08/3
http://www.openwall.com/lists/oss-security/2019/05/08/4
http://www.openwall.com/lists/oss-security/2019/05/08/5
http://www.securityfocus.com/bid/102837Third Party Advisory, VDB Entry
https://support.lenovo.com/product_security/LEN-15999Patch, Vendor Advisory

Timeline

Published: Jan 26, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-37636.7An attacker who obtains access to the location where the LXCA file system is stored may be able to access credentials of local LXCA accounts CVE-2017-37645.3A vulnerability was identified in Lenovo XClarity Administrator (LXCA) before 1.4.0 where LXCA user account names may be exposed to unauthen CVE-2017-37657.0In Enterprise Networking Operating System (ENOS) in Lenovo and IBM RackSwitch and BladeCenter products, an authentication bypass known as "H CVE-2017-37677.8A local privilege escalation vulnerability was identified in the Realtek audio driver versions prior to 6.0.1.8224 in some Lenovo ThinkPad p CVE-2017-37687.5An unprivileged attacker with connectivity to the IMM2 could cause a denial of service attack on the IMM2 (Versions earlier than 4.4 for Len CVE-2017-37708.8Privilege escalation vulnerability in LXCA versions earlier than 1.3.2 where an authenticated user may be able to abuse certain web interfac CVE-2017-37717.5System boot process is not adequately secured In Lenovo E95 and ThinkCentre M710s/M710t because systems were shipped from factory without co CVE-2017-37725.5A vulnerability was reported in Lenovo PC Manager versions prior to 2.6.40.3154 that could allow an attacker to cause a system reboot.CVE-2017-37749.8A stack overflow vulnerability was discovered within the web administration service in Integrated Management Module 2 (IMM2) earlier than ve CVE-2017-37756.4Some Lenovo System x server BIOS/UEFI versions, when Secure Boot mode is enabled by a system administrator, do not properly authenticate sig CVE-2017-37767.5Lenovo Help Android mobile app versions earlier than 6.1.2.0327 allowed information to be transmitted over an HTTP channel, permitting other CVE-2017-37908.6A vulnerability in the received packet parser of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) software co