CVE-2015-3322: Weak Encryption
First published: Thu Apr 16 2015(Updated: )
Lenovo ThinkServer RD350, RD450, RD550, RD650, and TD350 servers before 1.26.0 use weak encryption to store (1) user and (2) administrator BIOS passwords, which allows attackers to decrypt the passwords via unspecified vectors.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Lenovo ThinkServer RD650 | <=1.25.0 | |
| Lenovo ThinkServer RD650 | ||
| Lenovo ThinkServer TD350 | <=1.25.0 | |
| Lenovo ThinkServer TD350 | ||
| Lenovo ThinkServer RD350 Firmware | <=1.25.0 | |
| Lenovo ThinkServer RD350 | ||
| Lenovo ThinkServer RD550 | <=1.25.0 | |
| Lenovo ThinkServer RD550 | ||
| Lenovo ThinkServer RD450 | <=1.25.0 | |
| Lenovo ThinkServer RD450 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2015-3322?
CVE-2015-3322 is considered to have a high severity due to the use of weak encryption for sensitive BIOS passwords.
How do I fix CVE-2015-3322?
To mitigate CVE-2015-3322, users should update their Lenovo ThinkServer firmware to version 1.26.0 or later.
What systems are affected by CVE-2015-3322?
CVE-2015-3322 affects Lenovo ThinkServer RD350, RD450, RD550, RD650, and TD350 servers running firmware versions up to 1.25.0.
What kind of passwords are exposed in CVE-2015-3322?
CVE-2015-3322 exposes both user and administrator BIOS passwords, allowing attackers to decrypt them.
How can attackers exploit CVE-2015-3322?
Attackers can exploit CVE-2015-3322 through unspecified vectors to decrypt the weakly stored BIOS passwords.
- agent/references
- agent/softwarecombine
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/last-modified-date
- agent/remedy
- agent/author
- agent/severity
- agent/description
- agent/first-publish-date
- agent/event
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/lenovo
- canonical/lenovo thinkserver rd650
- version/lenovo thinkserver rd650/1.25.0
- canonical/lenovo thinkserver td350
- version/lenovo thinkserver td350/1.25.0
- canonical/lenovo thinkserver rd350 firmware
- version/lenovo thinkserver rd350 firmware/1.25.0
- canonical/lenovo thinkserver rd350
- canonical/lenovo thinkserver rd550
- version/lenovo thinkserver rd550/1.25.0
- canonical/lenovo thinkserver rd450
- version/lenovo thinkserver rd450/1.25.0