CVE-2024-8281

Friday, September 13, 2024

7.2

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Summary

An input validation weakness was discovered in XCC that could allow a valid, authenticated XCC user with elevated privileges to perform command injection through specially crafted command line input in the XCC SSH captive shell.

Affected Software

Vendor	Product	Version Range	Status
Lenovo	HX5530 Appliance (ThinkAgile) XCC	`0 < 4.71 AFBT48C`	affected
Lenovo	HX7530 Appliance (ThinkAgile) XCC	`0 < 4.71 AFBT48C`	affected
Lenovo	ST250 V3 (ThinkSystem) XCC	`0 < 2.10 CTX312G`	affected
Lenovo	VX3331 Certified Node (ThinkAgile) XCC	`0 < 4.71 AFBT48C`	affected
Lenovo	HX Enclosure Certified Node (ThinkAgile) XCC	`0 < 6.36 TEI3F4A`	affected
Lenovo	HX1021 Edge Certified Node 3yr (ThinkAgile) XCC	`0 < 4.11 TEI3E4A`	affected
Lenovo	HX1320 Appliance (ThinkAgile) XCC	`0 < 9.97 CDI3B4B`	affected
Lenovo	HX1321 Certified Node (ThinkAgile) XCC	`0 < 9.97 CDI3B4B`	affected
Lenovo	HX1331 Certified Node (ThinkAgile) XCC	`0 < 4.71 AFBT48C`	affected
Lenovo	HX1520-R Appliance (ThinkAgile) XCC	`0 < 9.97 CDI3B4B`	affected
Lenovo	HX1521-R Certified Node (ThinkAgile) XCC	`0 < 9.97 CDI3B4B`	affected
Lenovo	HX2320-E Appliance (ThinkAgile) XCC	`0 < 9.97 CDI3B4B`	affected
Lenovo	HX2321 Certified Node (ThinkAgile) XCC	`0 < 9.97 CDI3B4B`	affected
Lenovo	HX2330 Appliance (ThinkAgile) XCC	`0 < 4.71 AFBT48C`	affected
Lenovo	HX2331 Certified Node (ThinkAgile) XCC	`0 < 4.71 AFBT48C`	affected
Lenovo	HX2720-E Appliance (ThinkAgile) XCC	`0 < 6.36 TEI3F4A`	affected
Lenovo	HX3320 Appliance (ThinkAgile) XCC	`0 < 9.97 CDI3B4B`	affected
Lenovo	HX3321 Certified Node (ThinkAgile) XCC	`0 < 9.97 CDI3B4B`	affected
Lenovo	HX3330 Appliance (ThinkAgile) XCC	`0 < 4.71 AFBT48C`	affected
Lenovo	HX3331 Certified Node (ThinkAgile) XCC	`0 < 4.71 AFBT48C`	affected
Lenovo	HX3331 Node SAP HANA (ThinkAgile) XCC	`0 < 4.71 AFBT48C`	affected
Lenovo	HX3375 Appliance (ThinkAgile) XCC	`0 < 5.61 D8BT64D`	affected
Lenovo	HX3376 Certified Node (ThinkAgile) XCC	`0 < 5.61 D8BT64D`	affected
Lenovo	HX3520-G Appliance (ThinkAgile) XCC	`0 < 9.97 CDI3B4B`	affected
Lenovo	HX3521-G Certified Node (ThinkAgile) XCC	`0 < 9.97 CDI3B4B`	affected
Lenovo	HX3720 Appliance (ThinkAgile) XCC	`0 < 6.36 TEI3F4A`	affected
Lenovo	HX3721 Certified Node (ThinkAgile) XCC	`0 < 6.36 TEI3F4A`	affected
Lenovo	HX5520 Appliance (ThinkAgile) XCC	`0 < 9.97 CDI3B4B`	affected
Lenovo	HX5520-C Appliance (ThinkAgile) XCC	`0 < 9.97 CDI3B4B`	affected
Lenovo	HX5521 Certified Node (ThinkAgile) XCC	`0 < 9.97 CDI3B4B`	affected
Lenovo	HX5521-C Certified Node (ThinkAgile) XCC	`0 < 9.97 CDI3B4B`	affected
Lenovo	HX5531 Certified Node (ThinkAgile) XCC	`0 < 4.71 AFBT48C`	affected
Lenovo	HX7520 Appliance (ThinkAgile) XCC	`0 < 9.97 CDI3B4B`	affected
Lenovo	HX7521 Certified Node (ThinkAgile) XCC	`0 < 9.97 CDI3B4B`	affected
Lenovo	HX7530 Appl for SAP HANA (ThinkAgile) XCC	`0 < 4.71 AFBT48C`	affected
Lenovo	HX7531 Certified Node (ThinkAgile) XCC	`0 < 4.71 AFBT48C`	affected
Lenovo	HX7531 Node SAP HANA (ThinkAgile) XCC	`0 < 4.71 AFBT48C`	affected
Lenovo	HX7820 Appliance (ThinkAgile) XCC	`0 < 3.11 PSI354A`	affected
Lenovo	HX7821 Certified Node (ThinkAgile) XCC	`0 < 3.11 PSI354A`	affected
Lenovo	MX Edge Appliance - MX1020 (ThinkAgile) XCC	`0 < 4.11 TEI3E4A`	affected
Lenovo	MX3330-F All-flash Appliance (ThinkAgile) XCC	`0 < 4.71 AFBT48C`	affected
Lenovo	MX3330-H Hybrid Appliance (ThinkAgile) XCC	`0 < 4.71 AFBT48C`	affected
Lenovo	MX3331-F All-flash Certified node (ThinkAgile) XCC	`0 < 4.71 AFBT48C`	affected
Lenovo	MX3331-H Hybrid Certified node (ThinkAgile) XCC	`0 < 4.71 AFBT48C`	affected
Lenovo	MX3530 F All flash Appliance (ThinkAgile) XCC	`0 < 4.71 AFBT48C`	affected
Lenovo	MX3530-H Hybrid Appliance (ThinkAgile) XCC	`0 < 4.71 AFBT48C`	affected
Lenovo	MX3531 H Hybrid Certified node (ThinkAgile) XCC	`0 < 4.71 AFBT48C`	affected
Lenovo	MX3531-F All-flash Certified node (ThinkAgile) XCC	`0 < 4.71 AFBT48C`	affected
Lenovo	P920 Rack Workstation (ThinkStation) XCC	`0 < 9.97 CDI3B4B`	affected
Lenovo	SD530 (ThinkSystem) XCC	`0 < 6.36 TEI3F4A`	affected
Lenovo	SD530 V3 (ThinkSystem) XCC	`0 < 1.20 USX352`	affected
Lenovo	SD550 V3 (ThinkSystem) XCC	`0 < 1.20 USX352`	affected
Lenovo	SD630 V2 (ThinkSystem) XCC	`0 < 4.11 TGBT50C`	affected
Lenovo	SD650 DWC Dual Node Tray (ThinkSystem) XCC	`0 < 6.36 TEI3F4A`	affected
Lenovo	SD650 V2 (ThinkSystem) XCC	`0 < 4.11 TGBT50C`	affected
Lenovo	SD650 V3 (ThinkSystem) XCC	`0 < 6.10 USX350G`	affected
Lenovo	SD650-N V2 (ThinkSystem) XCC	`0 < 4.11 TGBT50C`	affected
Lenovo	SD665 V3 (ThinkSystem) XCC	`0 < 6.10 QGX340J`	affected
Lenovo	SE350 (ThinkSystem) XCC	`0 < 4.11 TEI3E4A`	affected
Lenovo	SE350 V2 (ThinkEdge) XCC	`0 < 3.11 IYX328M`	affected
Lenovo	SE360 V2 (ThinkEdge) XCC	`0 < 3.11 IYX328M`	affected
Lenovo	SE450 (ThinkEdge) XCC	`0 < 3.11 USX332X`	affected
Lenovo	SE455 V3 (ThinkEdge) XCC	`0 < 3.10 MBX308L`	affected
Lenovo	SN550 (ThinkSystem) XCC	`0 < 6.36 TEI3F4A`	affected
Lenovo	SN550 V2 (ThinkSystem) XCC	`0 < 4.11 TGBT50C`	affected
Lenovo	SN850 (ThinkSystem) XCC	`0 < 6.36 TEI3F4A`	affected
Lenovo	SR150 (ThinkSystem) XCC	`0 < 6.36 TEI3F4A`	affected
Lenovo	SR158 (ThinkSystem) XCC	`0 < 6.36 TEI3F4A`	affected
Lenovo	SR250 (ThinkSystem) XCC	`0 < 6.36 TEI3F4A`	affected
Lenovo	SR250 V2 (ThinkSystem) XCC	`0 < 4.11 TGBT50C`	affected
Lenovo	SR250 V3 (ThinkSystem) XCC	`0 < 2.10 CTX312G`	affected
Lenovo	SR258 (ThinkSystem) XCC	`0 < 6.36 TEI3F4A`	affected
Lenovo	SR258 V2 (ThinkSystem) XCC	`0 < 4.11 TGBT50C`	affected
Lenovo	SR258 V3 (ThinkSystem) XCC	`0 < 2.10 CTX312G`	affected
Lenovo	SR530 (ThinkSystem) XCC	`0 < 9.97 CDI3B4B`	affected
Lenovo	SR550 (ThinkSystem) XCC	`0 < 9.97 CDI3B4B`	affected
Lenovo	SR570 (ThinkSystem) XCC	`0 < 9.97 CDI3B4B`	affected
Lenovo	SR590 (ThinkSystem) XCC	`0 < 9.97 CDI3B4B`	affected
Lenovo	SR630 (ThinkSystem) XCC	`0 < 9.97 CDI3B4B`	affected
Lenovo	SR630 V2 (ThinkSystem) XCC	`0 < 4.71 AFBT48C`	affected
Lenovo	SR630 V3 (ThinkSystem) XCC	`0 < 5.10 ESX330M`	affected
Lenovo	SR635 V3 (ThinkSystem) XCC	`0 < 3.20 KAX334O`	affected
Lenovo	SR645 (ThinkSystem) XCC	`0 < 5.61 D8BT64D`	affected
Lenovo	SR645 V3 (ThinkSystem) XCC	`0 < 3.20 KAX334O`	affected
Lenovo	SR650 (ThinkSystem) XCC	`0 < 9.97 CDI3B4B`	affected
Lenovo	SR650 V2 (ThinkSystem) XCC	`0 < 4.71 AFBT48C`	affected
Lenovo	SR650 V3 (ThinkSystem) XCC	`0 < 5.10 ESX330M`	affected
Lenovo	SR655 V3 (ThinkSystem) XCC	`0 < 3.20 KAX334O`	affected
Lenovo	SR665 (ThinkSystem) XCC	`0 < 5.61 D8BT64D`	affected
Lenovo	SR665 V3 (ThinkSystem) XCC	`0 < 3.20 KAX334O`	affected
Lenovo	SR670 (ThinkSystem) XCC	`0 < 4.11 TEI3E4A`	affected
Lenovo	SR670 V2 (ThinkSystem) XCC	`0 < 4.11 TGBT50C`	affected
Lenovo	SR675 V3 (ThinkSystem) XCC	`0 < 6.10 QGX340J`	affected
Lenovo	SR850 (ThinkSystem) XCC	`0 < 6.36 TEI3F4A`	affected
Lenovo	SR850 V2 (ThinkSystem) XCC	`0 < 4.11 TGBT50C`	affected
Lenovo	SR850 V3 (ThinkSystem) XCC	`0 < 4.10 RSX312I`	affected
Lenovo	SR850P (ThinkSystem) XCC	`0 < 4.11 TEI3E4A`	affected
Lenovo	SR860 (ThinkSystem) XCC	`0 < 6.36 TEI3F4A`	affected
Lenovo	SR860 V2 (ThinkSystem) XCC	`0 < 4.11 TGBT50C`	affected
Lenovo	SR860 V3 (ThinkSystem) XCC	`0 < 4.10 RSX312I`	affected
Lenovo	SR950 (ThinkSystem) XCC	`0 < 3.11 PSI354A`	affected
Lenovo	SR950 V3 (ThinkSystem) XCC	`0 < 3.10 EBX308I`	affected
Lenovo	ST250 (ThinkSystem) XCC	`0 < 6.36 TEI3F4A`	affected
Lenovo	ST250 V2 (ThinkSystem) XCC	`0 < 4.11 TGBT50C`	affected
Lenovo	ST258 (ThinkSystem) XCC	`0 < 6.36 TEI3F4A`	affected
Lenovo	ST258 V2 (ThinkSystem) XCC	`0 < 4.11 TGBT50C`	affected
Lenovo	ST258 V3 (ThinkSystem) XCC	`0 < 2.10 CTX312G`	affected
Lenovo	ST550 (ThinkSystem) XCC	`0 < 9.97 CDI3B4B`	affected
Lenovo	ST650 V2 (ThinkSystem) XCC	`0 < 4.11 TGBT50C`	affected
Lenovo	ST650 V3 (ThinkSystem) XCC	`0 < 6.10 USX350G`	affected
Lenovo	ST658 V2 (ThinkSystem) XCC	`0 < 4.11 TGBT50C`	affected
Lenovo	ST658 V3 (ThinkSystem) XCC	`0 < 6.10 USX350G`	affected
Lenovo	ThinkAgile MX1021 on SE350 XCC	`0 < 4.11 TEI3E4A`	affected
Lenovo	VX 1SE Certified Node (ThinkAgile) XCC	`0 < 6.36 TEI3F4A`	affected
Lenovo	VX 2U4N Certified Node (ThinkAgile) XCC	`0 < 6.36 TEI3F4A`	affected
Lenovo	VX 4U Certified Node (ThinkAgile) XCC	`0 < 3.11 PSI354A`	affected
Lenovo	VX1320 (ThinkAgile) XCC	`0 < 6.36 TEI3F4A`	affected
Lenovo	VX2320 (ThinkAgile) XCC	`0 < 9.97 CDI3B4B`	affected
Lenovo	VX2330 Appliance (ThinkAgile) XCC	`0 < 4.71 AFBT48C`	affected
Lenovo	VX3320 (ThinkAgile) XCC	`0 < 9.97 CDI3B4B`	affected
Lenovo	VX3330 Appliance (ThinkAgile) XCC	`0 < 4.71 AFBT48C`	affected
Lenovo	VX3520-G (ThinkAgile) XCC	`0 < 9.97 CDI3B4B`	affected
Lenovo	VX3530-G Appliance (ThinkAgile) XCC	`0 < 4.71 AFBT48C`	affected
Lenovo	VX3720 (ThinkAgile) XCC	`0 < 6.36 TEI3F4A`	affected
Lenovo	VX5520 (ThinkAgile) XCC	`0 < 9.97 CDI3B4B`	affected
Lenovo	VX5530 Appliance (ThinkAgile) XCC	`0 < 4.71 AFBT48C`	affected
Lenovo	VX635 V3 Integrated System (ThinkAgile) XCC	`0 < 3.20 KAX334O`	affected
Lenovo	VX645 V3 Certified Node (ThinkAgile) XCC	`0 < 3.20 KAX334O`	affected
Lenovo	VX645 V3 Integrated System (ThinkAgile) XCC	`0 < 3.20 KAX334O`	affected
Lenovo	VX655 V3 Certified Node (ThinkAgile) XCC	`0 < 3.20 KAX334O`	affected
Lenovo	VX655 V3 Integrated System (ThinkAgile) XCC	`0 < 3.20 KAX334O`	affected
Lenovo	VX665 V3 Certified Node (ThinkAgile) XCC	`0 < 3.20 KAX334O`	affected
Lenovo	VX665 V3 Integrated System (ThinkAgile) XCC	`0 < 3.20 KAX334O`	affected
Lenovo	VX7320 N (ThinkAgile) XCC	`0 < 9.97 CDI3B4B`	affected
Lenovo	VX7330 Appliance (Thinkagile) XCC	`0 < 4.71 AFBT48C`	affected
Lenovo	VX7520 (ThinkAgile) XCC	`0 < 9.97 CDI3B4B`	affected
Lenovo	VX7520 N (ThinkAgile) XCC	`0 < 9.97 CDI3B4B`	affected
Lenovo	VX7530 Appliance (ThinkAgile) XCC	`0 < 4.71 AFBT48C`	affected
Lenovo	VX7531 Certified Node (ThinkAgile) XCC	`0 < 4.71 AFBT48C`	affected
Lenovo	VX7820 (ThinkAgile) XCC	`0 < 3.11 PSI354A`	affected

Weaknesses

CWE-78: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

ADP Enrichment

CISA ADP Vulnrichment

SSVC:
Exploitation: none
- Automatable: no
- Technical Impact: total

References

https://support.lenovo.com/us/en/product_security/LEN-172051

Feedback

Was this page helpful?

Glad to hear it! Please tell us how we can improve.

Sorry to hear that. Please tell us how we can improve.