A privilege escalation vulnerability was discovered in XCC that could allow an authenticated XCC user with elevated privileges to perform c…

published 2024-07-26 2 y ago modified 2026-06-17 4 mo ago also EUVD-2024-37384

cvss: 7.2; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 1.0%; EPSS 1.0% chance of exploitation in 30 days, percentile 63%
public exploits: 0; none known

A privilege escalation vulnerability was discovered in XCC that could allow an authenticated XCC user with elevated privileges to perform command injection via specially crafted IPMI commands.

Patch / fix

fixed in 30

lenovo thinkagile_hx5530_firmware 4.71
lenovo thinkagile_hx7530_firmware 4.71
lenovo thinkagile_vx3331_firmware 4.71
lenovo thinkagile_hx_enclosure_certified_node_firmware 4.11
lenovo thinkagile_hx1021_edg_firmware 4.11
lenovo thinkagile_hx1320_firmware 9.97
lenovo thinkagile_hx1331_firmware 4.71
lenovo thinkagile_hx1321_firmware 9.97
lenovo thinkagile_hx1520-r_firmware 9.97
lenovo thinkagile_hx1521-r_firmware 9.97
lenovo thinkagile_hx2320-e_firmware 9.97
lenovo thinkagile_hx2321_firmware 9.97
lenovo thinkagile_hx2330_firmware 4.71
lenovo thinkagile_hx2331_firmware 4.71
lenovo thinkagile_hx2720-e_firmware 4.11
lenovo thinkagile_hx3320_firmware 9.97
lenovo thinkagile_hx3321_firmware 9.97
lenovo thinkagile_hx3330_firmware 4.71
lenovo thinkagile_hx3331 4.71
lenovo thinkagile_hx3375_firmware 5.61
lenovo thinkagile_hx3376_firmware 5.61
lenovo thinkagile_hx3520-g_firmware 9.97
lenovo thinkagile_hx3521-g_firmware 9.97
lenovo thinkagile_hx3720_firmware 4.11
lenovo thinkagile_hx3721_firmware 4.11
lenovo thinkagile_hx5520-c_firmware 9.97
lenovo thinkagile_hx5521-c_firmware 9.97
lenovo thinkagile_hx5531_firmware 4.71
lenovo thinkagile_hx7520_firmware 9.97
lenovo thinkagile_hx7521_firmware 9.97

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: total
Assessed: 2 y ago (2024-07-26)

Exploit prediction

1.01% chance of exploitation in the next 30 days, higher than 63% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	7.2	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Affected products

Lenovo XClarity Controller
lenovo thinkagile_hx5530_firmware
lenovo thinkagile_hx7530_firmware
lenovo thinkagile_vx3331_firmware
lenovo thinkagile_hx_enclosure_certified_node_firmware
lenovo thinkagile_hx1021_edg_firmware
lenovo thinkagile_hx1320_firmware
lenovo thinkagile_hx1331_firmware
lenovo thinkagile_hx1321_firmware
lenovo thinkagile_hx1520-r_firmware
lenovo thinkagile_hx1521-r_firmware
lenovo thinkagile_hx2320-e_firmware
lenovo thinkagile_hx2321_firmware
lenovo thinkagile_hx2330_firmware
lenovo thinkagile_hx2331_firmware
lenovo thinkagile_hx2720-e_firmware
lenovo thinkagile_hx3320_firmware
lenovo thinkagile_hx3321_firmware
lenovo thinkagile_hx3330_firmware
lenovo thinkagile_hx3331
lenovo thinkagile_hx3375_firmware
lenovo thinkagile_hx3376_firmware
lenovo thinkagile_hx3520-g_firmware
lenovo thinkagile_hx3521-g_firmware
lenovo thinkagile_hx3720_firmware
lenovo thinkagile_hx3721_firmware
lenovo thinkagile_hx5520-c_firmware
lenovo thinkagile_hx5521-c_firmware
lenovo thinkagile_hx5531_firmware
lenovo thinkagile_hx7520_firmware
lenovo thinkagile_hx7521_firmware
lenovo thinkagile_hx7531_firmware
lenovo thinkagile_hx7820_firmware
lenovo thinkagile_hx7821_firmware
lenovo thinkagile_mx1020_firmware
lenovo thinkagile_mx3330-f_firmware
lenovo thinkagile_mx3330-h_firmware
lenovo thinkagile_mx3331-f_firmware
lenovo thinkagile_mx3331-h_firmware
lenovo thinkagile_mx3530_f_firmware
lenovo thinkagile_mx3530-h_firmware
lenovo thinkagile_mx3531-f_firmware
lenovo thinkagile_vx1320_firmware
lenovo thinkagile_vx2320_firmware
lenovo thinkagile_vx2330_firmware
lenovo thinkagile_vx3320_firmware
lenovo thinkagile_vx3330_firmware
lenovo thinkagile_vx3520-g_firmware
lenovo thinkagile_vx3530-g_firmware
lenovo thinkagile_vx3720_firmware

Classification

Weakness

CWE-78 Improper Neutralization of Special Elements used in an OS Command

References

support.lenovo.com /us/en/product_security/LEN-156781

Sources

CVE List CVE-2024-38512
NVD CVE-2024-38512

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary