CVE-2024-8278 
A privilege escalation vulnerability was discovered in XCC that could allow a valid, authenticated XCC user with elevated privileges to perform command injection via specially crafted IPMI commands.
Problem types: cwe_id: CWE-78
description: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products: vendor: Lenovo
product: HX5530 Appliance (ThinkAgile) XCC
default_status: unaffected
vendor: Lenovo
product: HX7530 Appliance (ThinkAgile) XCC
default_status: unaffected
vendor: Lenovo
product: ST250 V3 (ThinkSystem) XCC
default_status: unaffected
vendor: Lenovo
product: VX3331 Certified Node (ThinkAgile) XCC
default_status: unaffected
vendor: Lenovo
product: HX Enclosure Certified Node (ThinkAgile) XCC
default_status: unaffected
vendor: Lenovo
product: HX1021 Edge Certified Node 3yr (ThinkAgile) XCC
default_status: unaffected
vendor: Lenovo
product: HX1320 Appliance (ThinkAgile) XCC
default_status: unaffected
vendor: Lenovo
product: HX1321 Certified Node (ThinkAgile) XCC
default_status: unaffected
vendor: Lenovo
product: HX1331 Certified Node (ThinkAgile) XCC
default_status: unaffected
vendor: Lenovo
product: HX1520-R Appliance (ThinkAgile) XCC
default_status: unaffected
vendor: Lenovo
product: HX1521-R Certified Node (ThinkAgile) XCC
default_status: unaffected
vendor: Lenovo
product: HX2320-E Appliance (ThinkAgile) XCC
default_status: unaffected
vendor: Lenovo
product: HX2321 Certified Node (ThinkAgile) XCC
default_status: unaffected
vendor: Lenovo
product: HX2330 Appliance (ThinkAgile) XCC
default_status: unaffected
vendor: Lenovo
product: HX2331 Certified Node (ThinkAgile) XCC
default_status: unaffected
vendor: Lenovo
product: HX2720-E Appliance (ThinkAgile) XCC
default_status: unaffected
vendor: Lenovo
product: HX3320 Appliance (ThinkAgile) XCC
default_status: unaffected
vendor: Lenovo
product: HX3321 Certified Node (ThinkAgile) XCC
default_status: unaffected
vendor: Lenovo
product: HX3330 Appliance (ThinkAgile) XCC
default_status: unaffected
vendor: Lenovo
product: HX3331 Certified Node (ThinkAgile) XCC
default_status: unaffected
vendor: Lenovo
product: HX3331 Node SAP HANA (ThinkAgile) XCC
default_status: unaffected
vendor: Lenovo
product: HX3375 Appliance (ThinkAgile) XCC
default_status: unaffected
vendor: Lenovo
product: HX3376 Certified Node (ThinkAgile) XCC
default_status: unaffected
vendor: Lenovo
product: HX3520-G Appliance (ThinkAgile) XCC
default_status: unaffected
vendor: Lenovo
product: HX3521-G Certified Node (ThinkAgile) XCC
default_status: unaffected
vendor: Lenovo
product: HX3720 Appliance (ThinkAgile) XCC
default_status: unaffected
vendor: Lenovo
product: HX3721 Certified Node (ThinkAgile) XCC
default_status: unaffected
vendor: Lenovo
product: HX5520 Appliance (ThinkAgile) XCC
default_status: unaffected
vendor: Lenovo
product: HX5520-C Appliance (ThinkAgile) XCC
default_status: unaffected
vendor: Lenovo
product: HX5521 Certified Node (ThinkAgile) XCC
default_status: unaffected
vendor: Lenovo
product: HX5521-C Certified Node (ThinkAgile) XCC
default_status: unaffected
vendor: Lenovo
product: HX5531 Certified Node (ThinkAgile) XCC
default_status: unaffected
vendor: Lenovo
product: HX7520 Appliance (ThinkAgile) XCC
default_status: unaffected
vendor: Lenovo
product: HX7521 Certified Node (ThinkAgile) XCC
default_status: unaffected
vendor: Lenovo
product: HX7530 Appl for SAP HANA (ThinkAgile) XCC
default_status: unaffected
vendor: Lenovo
product: HX7531 Certified Node (ThinkAgile) XCC
default_status: unaffected
vendor: Lenovo
product: HX7531 Node SAP HANA (ThinkAgile) XCC
default_status: unaffected
vendor: Lenovo
product: HX7820 Appliance (ThinkAgile) XCC
default_status: unaffected
vendor: Lenovo
product: HX7821 Certified Node (ThinkAgile) XCC
default_status: unaffected
vendor: Lenovo
product: MX Edge Appliance - MX1020 (ThinkAgile) XCC
default_status: unaffected
vendor: Lenovo
product: MX3330-F All-flash Appliance (ThinkAgile) XCC
default_status: unaffected
vendor: Lenovo
product: MX3330-H Hybrid Appliance (ThinkAgile) XCC
default_status: unaffected
vendor: Lenovo
product: MX3331-F All-flash Certified node (ThinkAgile) XCC
default_status: unaffected
vendor: Lenovo
product: MX3331-H Hybrid Certified node (ThinkAgile) XCC
default_status: unaffected
vendor: Lenovo
product: MX3530 F All flash Appliance (ThinkAgile) XCC
default_status: unaffected
vendor: Lenovo
product: MX3530-H Hybrid Appliance (ThinkAgile) XCC
default_status: unaffected
vendor: Lenovo
product: MX3531 H Hybrid Certified node (ThinkAgile) XCC
default_status: unaffected
vendor: Lenovo
product: MX3531-F All-flash Certified node (ThinkAgile) XCC
default_status: unaffected
vendor: Lenovo
product: P920 Rack Workstation (ThinkStation) XCC
default_status: unaffected
vendor: Lenovo
product: SD530 (ThinkSystem) XCC
default_status: unaffected
vendor: Lenovo
product: SD530 V3 (ThinkSystem) XCC
default_status: unaffected
vendor: Lenovo
product: SD550 V3 (ThinkSystem) XCC
default_status: unaffected
vendor: Lenovo
product: SD630 V2 (ThinkSystem) XCC
default_status: unaffected
vendor: Lenovo
product: SD650 DWC Dual Node Tray (ThinkSystem) XCC
default_status: unaffected
vendor: Lenovo
product: SD650 V2 (ThinkSystem) XCC
default_status: unaffected
vendor: Lenovo
product: SD650 V3 (ThinkSystem) XCC
default_status: unaffected
vendor: Lenovo
product: SD650-N V2 (ThinkSystem) XCC
default_status: unaffected
vendor: Lenovo
product: SD665 V3 (ThinkSystem) XCC
default_status: unaffected
vendor: Lenovo
product: SE350 (ThinkSystem) XCC
default_status: unaffected
vendor: Lenovo
product: SE350 V2 (ThinkEdge) XCC
default_status: unaffected
vendor: Lenovo
product: SE360 V2 (ThinkEdge) XCC
default_status: unaffected
vendor: Lenovo
product: SE450 (ThinkEdge) XCC
default_status: unaffected
vendor: Lenovo
product: SE455 V3 (ThinkEdge) XCC
default_status: unaffected
vendor: Lenovo
product: SN550 (ThinkSystem) XCC
default_status: unaffected
vendor: Lenovo
product: SN550 V2 (ThinkSystem) XCC
default_status: unaffected
vendor: Lenovo
product: SN850 (ThinkSystem) XCC
default_status: unaffected
vendor: Lenovo
product: SR150 (ThinkSystem) XCC
default_status: unaffected
vendor: Lenovo
product: SR158 (ThinkSystem) XCC
default_status: unaffected
vendor: Lenovo
product: SR250 (ThinkSystem) XCC
default_status: unaffected
vendor: Lenovo
product: SR250 V2 (ThinkSystem) XCC
default_status: unaffected
vendor: Lenovo
product: SR250 V3 (ThinkSystem) XCC
default_status: unaffected
vendor: Lenovo
product: SR258 (ThinkSystem) XCC
default_status: unaffected
vendor: Lenovo
product: SR258 V2 (ThinkSystem) XCC
default_status: unaffected
vendor: Lenovo
product: SR258 V3 (ThinkSystem) XCC
default_status: unaffected
vendor: Lenovo
product: SR530 (ThinkSystem) XCC
default_status: unaffected
vendor: Lenovo
product: SR550 (ThinkSystem) XCC
default_status: unaffected
vendor: Lenovo
product: SR570  (ThinkSystem) XCC
default_status: unaffected
vendor: Lenovo
product: SR590 (ThinkSystem) XCC
default_status: unaffected
vendor: Lenovo
product: SR630  (ThinkSystem) XCC
default_status: unaffected
vendor: Lenovo
product: SR630 V2 (ThinkSystem) XCC
default_status: unaffected
vendor: Lenovo
product: SR630 V3 (ThinkSystem) XCC
default_status: unaffected
vendor: Lenovo
product: SR635 V3 (ThinkSystem) XCC
default_status: unaffected
vendor: Lenovo
product: SR645 (ThinkSystem) XCC
default_status: unaffected
vendor: Lenovo
product: SR645 V3 (ThinkSystem) XCC
default_status: unaffected
vendor: Lenovo
product: SR650  (ThinkSystem) XCC
default_status: unaffected
vendor: Lenovo
product: SR650 V2 (ThinkSystem) XCC
default_status: unaffected
vendor: Lenovo
product: SR650 V3 (ThinkSystem) XCC
default_status: unaffected
vendor: Lenovo
product: SR655 V3 (ThinkSystem) XCC
default_status: unaffected
vendor: Lenovo
product: SR665 (ThinkSystem) XCC
default_status: unaffected
vendor: Lenovo
product: SR665 V3 (ThinkSystem) XCC
default_status: unaffected
vendor: Lenovo
product: SR670 (ThinkSystem) XCC
default_status: unaffected
vendor: Lenovo
product: SR670 V2 (ThinkSystem) XCC
default_status: unaffected
vendor: Lenovo
product: SR675 V3 (ThinkSystem) XCC
default_status: unaffected
vendor: Lenovo
product: SR850 (ThinkSystem) XCC
default_status: unaffected
vendor: Lenovo
product: SR850 V2 (ThinkSystem) XCC
default_status: unaffected
vendor: Lenovo
product: SR850 V3 (ThinkSystem) XCC
default_status: unaffected
vendor: Lenovo
product: SR850P (ThinkSystem) XCC
default_status: unaffected
vendor: Lenovo
product: SR860 (ThinkSystem) XCC
default_status: unaffected
vendor: Lenovo
product: SR860 V2 (ThinkSystem) XCC
default_status: unaffected
vendor: Lenovo
product: SR860 V3 (ThinkSystem) XCC
default_status: unaffected
vendor: Lenovo
product: SR950 (ThinkSystem) XCC
default_status: unaffected
vendor: Lenovo
product: SR950 V3 (ThinkSystem) XCC
default_status: unaffected
vendor: Lenovo
product: ST250 (ThinkSystem) XCC
default_status: unaffected
vendor: Lenovo
product: ST250 V2 (ThinkSystem) XCC
default_status: unaffected
vendor: Lenovo
product: ST258 (ThinkSystem) XCC
default_status: unaffected
vendor: Lenovo
product: ST258 V2 (ThinkSystem) XCC
default_status: unaffected
vendor: Lenovo
product: ST258 V3 (ThinkSystem) XCC
default_status: unaffected
vendor: Lenovo
product: ST550 (ThinkSystem) XCC
default_status: unaffected
vendor: Lenovo
product: ST650 V2 (ThinkSystem) XCC
default_status: unaffected
vendor: Lenovo
product: ST650 V3 (ThinkSystem) XCC
default_status: unaffected
vendor: Lenovo
product: ST658 V2 (ThinkSystem) XCC
default_status: unaffected
vendor: Lenovo
product: ST658 V3 (ThinkSystem) XCC
default_status: unaffected
vendor: Lenovo
product: ThinkAgile MX1021 on SE350 XCC
default_status: unaffected
vendor: Lenovo
product: VX 1SE Certified Node (ThinkAgile) XCC
default_status: unaffected
vendor: Lenovo
product: VX 2U4N Certified Node (ThinkAgile) XCC
default_status: unaffected
vendor: Lenovo
product: VX 4U Certified Node (ThinkAgile) XCC
default_status: unaffected
vendor: Lenovo
product: VX1320 (ThinkAgile) XCC
default_status: unaffected
vendor: Lenovo
product: VX2320 (ThinkAgile) XCC
default_status: unaffected
vendor: Lenovo
product: VX2330 Appliance (ThinkAgile) XCC
default_status: unaffected
vendor: Lenovo
product: VX3320 (ThinkAgile) XCC
default_status: unaffected
vendor: Lenovo
product: VX3330 Appliance (ThinkAgile) XCC
default_status: unaffected
vendor: Lenovo
product: VX3520-G (ThinkAgile) XCC
default_status: unaffected
vendor: Lenovo
product: VX3530-G Appliance (ThinkAgile) XCC
default_status: unaffected
vendor: Lenovo
product: VX3720 (ThinkAgile) XCC
default_status: unaffected
vendor: Lenovo
product: VX5520 (ThinkAgile) XCC
default_status: unaffected
vendor: Lenovo
product: VX5530 Appliance (ThinkAgile) XCC
default_status: unaffected
vendor: Lenovo
product: VX635 V3 Integrated System (ThinkAgile) XCC
default_status: unaffected
vendor: Lenovo
product: VX645 V3 Certified Node (ThinkAgile) XCC
default_status: unaffected
vendor: Lenovo
product: VX645 V3 Integrated System (ThinkAgile) XCC
default_status: unaffected
vendor: Lenovo
product: VX655 V3 Certified Node (ThinkAgile) XCC
default_status: unaffected
vendor: Lenovo
product: VX655 V3 Integrated System (ThinkAgile) XCC
default_status: unaffected
vendor: Lenovo
product: VX665 V3 Certified Node (ThinkAgile) XCC
default_status: unaffected
vendor: Lenovo
product: VX665 V3 Integrated System (ThinkAgile) XCC
default_status: unaffected
vendor: Lenovo
product: VX7320 N (ThinkAgile) XCC
default_status: unaffected
vendor: Lenovo
product: VX7330 Appliance (Thinkagile) XCC
default_status: unaffected
vendor: Lenovo
product: VX7520 (ThinkAgile) XCC
default_status: unaffected
vendor: Lenovo
product: VX7520 N (ThinkAgile) XCC
default_status: unaffected
vendor: Lenovo
product: VX7530 Appliance (ThinkAgile) XCC
default_status: unaffected
vendor: Lenovo
product: VX7531 Certified Node (ThinkAgile) XCC
default_status: unaffected
vendor: Lenovo
product: VX7820 (ThinkAgile) XCC
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.2
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2024-09-13T17:27:19.968Z