Log in Start free

Vulnerability · Published Sep 13, 2024 · Assigned by lenovo

CVE-2024-8281

High 7.2

In plain English

A high-severity OS command injection in HX Enclosure Certified Node (ThinkAgile) XCC from Lenovo. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 64% of all known vulnerabilities).

Severity (CVSS 3.1)7.2High
Exploit odds (30 days)1.0%top 36.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

An input validation weakness was discovered in XCC that could allow a valid, authenticated XCC user with elevated privileges to perform command injection through specially crafted command line input in the XCC SSH captive shell.

Affected products (as reported)

VendorProductVersions
Lenovo HX5530 Appliance (ThinkAgile) XCC 0 – before 4.71 AFBT48C
Lenovo HX7530 Appliance (ThinkAgile) XCC 0 – before 4.71 AFBT48C
Lenovo ST250 V3 (ThinkSystem) XCC 0 – before 2.10 CTX312G
Lenovo VX3331 Certified Node (ThinkAgile) XCC 0 – before 4.71 AFBT48C
Lenovo HX Enclosure Certified Node (ThinkAgile) XCC 0 – before 6.36 TEI3F4A
Lenovo HX1021 Edge Certified Node 3yr (ThinkAgile) XCC 0 – before 4.11 TEI3E4A
Lenovo HX1320 Appliance (ThinkAgile) XCC 0 – before 9.97 CDI3B4B
Lenovo HX1321 Certified Node (ThinkAgile) XCC 0 – before 9.97 CDI3B4B
Lenovo HX1331 Certified Node (ThinkAgile) XCC 0 – before 4.71 AFBT48C
Lenovo HX1520-R Appliance (ThinkAgile) XCC 0 – before 9.97 CDI3B4B
Lenovo HX1521-R Certified Node (ThinkAgile) XCC 0 – before 9.97 CDI3B4B
Lenovo HX2320-E Appliance (ThinkAgile) XCC 0 – before 9.97 CDI3B4B
Lenovo HX2321 Certified Node (ThinkAgile) XCC 0 – before 9.97 CDI3B4B
Lenovo HX2330 Appliance (ThinkAgile) XCC 0 – before 4.71 AFBT48C
Lenovo HX2331 Certified Node (ThinkAgile) XCC 0 – before 4.71 AFBT48C
Lenovo HX2720-E Appliance (ThinkAgile) XCC 0 – before 6.36 TEI3F4A
Lenovo HX3320 Appliance (ThinkAgile) XCC 0 – before 9.97 CDI3B4B
Lenovo HX3321 Certified Node (ThinkAgile) XCC 0 – before 9.97 CDI3B4B
Lenovo HX3330 Appliance (ThinkAgile) XCC 0 – before 4.71 AFBT48C
Lenovo HX3331 Certified Node (ThinkAgile) XCC 0 – before 4.71 AFBT48C
Lenovo HX3331 Node SAP HANA (ThinkAgile) XCC 0 – before 4.71 AFBT48C
Lenovo HX3375 Appliance (ThinkAgile) XCC 0 – before 5.61 D8BT64D
Lenovo HX3376 Certified Node (ThinkAgile) XCC 0 – before 5.61 D8BT64D
Lenovo HX3520-G Appliance (ThinkAgile) XCC 0 – before 9.97 CDI3B4B
Lenovo HX3521-G Certified Node (ThinkAgile) XCC 0 – before 9.97 CDI3B4B
Lenovo HX3720 Appliance (ThinkAgile) XCC 0 – before 6.36 TEI3F4A
Lenovo HX3721 Certified Node (ThinkAgile) XCC 0 – before 6.36 TEI3F4A
Lenovo HX5520 Appliance (ThinkAgile) XCC 0 – before 9.97 CDI3B4B
Lenovo HX5520-C Appliance (ThinkAgile) XCC 0 – before 9.97 CDI3B4B
Lenovo HX5521 Certified Node (ThinkAgile) XCC 0 – before 9.97 CDI3B4B

Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

References