Login Request a demo
High severity · published Jul 26, 2024
CVE-2024-38510
A privilege escalation vulnerability was discovered in the SSH captive command shell interface that could allow an authenticated XCC user with elevated privileges to perform…
7.2
CVSS
1.1%
EPSS
No
On KEV
Description
A privilege escalation vulnerability was discovered in the SSH captive command shell interface that could allow an authenticated XCC user with elevated privileges to perform command injection via specially crafted file uploads.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.1% · higher than 65% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
XC
XClarity Controller · Lenovo
various · source: vendor
TH
Thinkagile HX Enclosure Certified Node Firmware · Lenovo
before 4.11 · source: CISA
TH
Thinkagile Hx1021 Edg Firmware · Lenovo
before 4.11 · source: CISA
TH
Thinkagile Hx1320 Firmware · Lenovo
before 9.97 · source: CISA
TH
Thinkagile Hx1321 Firmware · Lenovo
before 9.97 · source: CISA
TH
Thinkagile Hx1331 Firmware · Lenovo
before 4.71 · source: CISA
TH
Thinkagile Hx1520-r Firmware · Lenovo
before 9.97 · source: CISA
TH
Thinkagile Hx1521-r Firmware · Lenovo
before 9.97 · source: CISA
TH
Thinkagile Hx2320-e Firmware · Lenovo
before 9.97 · source: CISA
TH
Thinkagile Hx2321 Firmware · Lenovo
before 9.97 · source: CISA
TH
Thinkagile Hx2330 Firmware · Lenovo
before 4.71 · source: CISA
TH
Thinkagile Hx2331 Firmware · Lenovo
before 4.71 · source: CISA
Affected product
XC
XClarity Controller
Lenovo
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-38510
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-38510
support.lenovo.com
https://support.lenovo.com/us/en/product_security/LEN-156781
More from XClarity Controller
7.2
CVE-2024-38512
A privilege escalation vulnerability was discovered in XCC that could allow an authenticated XCC user with elevated privileges to perform command injection via specially crafted…
7.2
CVE-2024-38511
A privilege escalation vulnerability was discovered in an upload processing functionality of XCC that could allow an authenticated XCC user with elevated privileges to perform…
7.2
CVE-2024-38509
A privilege escalation vulnerability was discovered in XCC that could allow an authenticated XCC user with elevated privileges to execute arbitrary code via a specially crafted…
7.2
CVE-2024-38508
A privilege escalation vulnerability was discovered in the web interface or SSH captive command shell interface of XCC that could allow an authenticated XCC user with elevated…
6.5
CVE-2019-6187
A stored CSV Injection vulnerability was reported in Lenovo XClarity Controller (XCC) that could allow an administrative or other appropriately permissioned user to store…