Back
CVE-2017-3742
In Lenovo Connect2 versions earlier than 4.2.5.4885 for Windows and 4.2.5.3071 for Android, when an ad-hoc connection is made between two…
Medium4.8EPSS 0.53%
- Published
- Updated
- Reserved
- Assigned by
- lenovo
Description
In Lenovo Connect2 versions earlier than 4.2.5.4885 for Windows and 4.2.5.3071 for Android, when an ad-hoc connection is made between two systems for the purpose of sharing files, the password for this ad-hoc connection will be stored in a user-readable location. An attacker with read access to the user's contents could connect to the Connect2 hotspot and see the contents of files while they are being transferred between the two systems.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| NVDNVD · Modified | 3.0 | Medium4.8 | CVSS:3.0/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N |
- EPSS (exploitation in 30 days)
- 0.53% · top 55% of all CVEs (4 Nov 2026)
Loading the EPSS history…
The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 4.8.
Weakness
- Disclosure of ad-hoc wifi network key stored in user-readable location
- CWE-200 (opens in a new tab)All about CWE-200 and its CVEs
Affected products
Lenovo Group Ltd. · Lenovo Connect2
- affected Earlier than 4.2.5.4885 for Windows and 4.2.5.3071 for Android.
References (1)
- https://support.lenovo.com/us/en/product_security/LEN-14398 (opens in a new tab)x_refsource_CONFIRMx_transferred
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2017-3742)Record last updated .