Is CVE-2019-19756 actively exploited?

No active exploitation of CVE-2019-19756 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2019-19756 be exploited remotely?

No. CVE-2019-19756 requires local access to exploit.

What is the CVSS score of CVE-2019-19756?

CVE-2019-19756 has a CVSS score of 6.0 (MEDIUM).

HOME VULNERABILITIESCVE-2019-19756

MEDIUM

CVE-2019-19756

CWE-532Published: March 13, 2020· Updated: Jun 17, 2026

6.0

CVSS v3.1

Official Description

An internal product security audit of Lenovo XClarity Administrator (LXCA) discovered Windows OS credentials, used to perform driver updates of managed systems, being written to a log file in clear text. This only affects LXCA version 2.6.0 when performing a Windows driver update. Affected logs are only accessible to authorized users in the First Failure Data Capture (FFDC) service log and log files on LXCA.

NVD Source

Technical Analysis

CVE-2019-19756 requires local access, meaning attackers must already have a foothold on the target system.

Exploitation requires high privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), with a CVSS base score of 6.0.