Analyst readout for executives and security teams
Plain-English summary
This issue affects Lenovo XClarity Administrator before version 1.3.2. If an attacker can access the storage location for the LXCA file system, they may be able to access credentials for local LXCA accounts. The public data does not provide CVSS scoring or detailed impact metrics.
Executive priority
Prioritize remediation for any LXCA deployment below 1.3.2. The main business risk is credential exposure after storage access, not confirmed internet-scale exploitation.
Technical view
CVE-2017-3763 is a credential exposure issue in Lenovo XClarity Administrator versions earlier than 1.3.2. The stated precondition is attacker access to the location where the LXCA file system is stored. The exposed credential scope is local LXCA accounts.
Likely exposure
Exposure is limited to environments running LXCA earlier than 1.3.2, especially where the LXCA file-system storage location is accessible beyond tightly controlled administrators.
Exploitation context
CISA KEV status is false in the provided bundle. The sources do not report active exploitation, exploit maturity, or remote exploitability. The known scenario requires prior access to LXCA file-system storage.
Researcher notes
The public bundle is sparse: no CVSS vector, CWE, exploit details, or complete Lenovo advisory text are provided. Treat impact analysis as bounded to credential access for local LXCA accounts under the stated storage-access precondition.
Mitigation direction
- Upgrade Lenovo XClarity Administrator to version 1.3.2 or later.
- Review Lenovo advisory LEN-16333 for vendor-specific remediation guidance.
- Restrict access to the LXCA file-system storage location.
- Rotate local LXCA account credentials after upgrading or containment.
Validation and detection
- Inventory Lenovo XClarity Administrator deployments and record versions.
- Confirm no LXCA instance is earlier than version 1.3.2.
- Review permissions around the LXCA file-system storage location.
- Check whether local LXCA credentials were exposed before remediation.
Public sources used
Based on public source material and reviewed before publication.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2017-3763 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://support.lenovo.com/us/en/product_security/LEN-16333CVE reference · x_refsource_CONFIRM
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.