An input validation weakness was discovered in XCC that could allow a valid, authenticated XCC user with elevated privileges to perform com…

published 2024-09-13 2 y ago modified 2026-06-17 4 mo ago also EUVD-2024-49065

cvss: 7.2; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 1.0%; EPSS 1.0% chance of exploitation in 30 days, percentile 63%
public exploits: 0; none known

An input validation weakness was discovered in XCC that could allow a valid, authenticated XCC user with elevated privileges to perform command injection through specially crafted command line input in the XCC SSH captive shell.

Patch / fix

fixed in 30

Lenovo HX5530 Appliance (ThinkAgile) XCC 4.71 AFBT48C
Lenovo HX7530 Appliance (ThinkAgile) XCC 4.71 AFBT48C
Lenovo ST250 V3 (ThinkSystem) XCC 2.10 CTX312G
Lenovo VX3331 Certified Node (ThinkAgile) XCC 4.71 AFBT48C
Lenovo HX Enclosure Certified Node (ThinkAgile) XCC 6.36 TEI3F4A
Lenovo HX1021 Edge Certified Node 3yr (ThinkAgile) XCC 4.11 TEI3E4A
Lenovo HX1320 Appliance (ThinkAgile) XCC 9.97 CDI3B4B
Lenovo HX1321 Certified Node (ThinkAgile) XCC 9.97 CDI3B4B
Lenovo HX1331 Certified Node (ThinkAgile) XCC 4.71 AFBT48C
Lenovo HX1520-R Appliance (ThinkAgile) XCC 9.97 CDI3B4B
Lenovo HX1521-R Certified Node (ThinkAgile) XCC 9.97 CDI3B4B
Lenovo HX2320-E Appliance (ThinkAgile) XCC 9.97 CDI3B4B
Lenovo HX2321 Certified Node (ThinkAgile) XCC 9.97 CDI3B4B
Lenovo HX2330 Appliance (ThinkAgile) XCC 4.71 AFBT48C
Lenovo HX2331 Certified Node (ThinkAgile) XCC 4.71 AFBT48C
Lenovo HX2720-E Appliance (ThinkAgile) XCC 6.36 TEI3F4A
Lenovo HX3320 Appliance (ThinkAgile) XCC 9.97 CDI3B4B
Lenovo HX3321 Certified Node (ThinkAgile) XCC 9.97 CDI3B4B
Lenovo HX3330 Appliance (ThinkAgile) XCC 4.71 AFBT48C
Lenovo HX3331 Certified Node (ThinkAgile) XCC 4.71 AFBT48C
Lenovo HX3331 Node SAP HANA (ThinkAgile) XCC 4.71 AFBT48C
Lenovo HX3375 Appliance (ThinkAgile) XCC 5.61 D8BT64D
Lenovo HX3376 Certified Node (ThinkAgile) XCC 5.61 D8BT64D
Lenovo HX3520-G Appliance (ThinkAgile) XCC 9.97 CDI3B4B
Lenovo HX3521-G Certified Node (ThinkAgile) XCC 9.97 CDI3B4B
Lenovo HX3720 Appliance (ThinkAgile) XCC 6.36 TEI3F4A
Lenovo HX3721 Certified Node (ThinkAgile) XCC 6.36 TEI3F4A
Lenovo HX5520 Appliance (ThinkAgile) XCC 9.97 CDI3B4B
Lenovo HX5520-C Appliance (ThinkAgile) XCC 9.97 CDI3B4B
Lenovo HX5521 Certified Node (ThinkAgile) XCC 9.97 CDI3B4B

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: total
Assessed: 2 y ago (2024-09-13)

Exploit prediction

1.03% chance of exploitation in the next 30 days, higher than 63% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	7.2	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Affected products

Lenovo HX5530 Appliance (ThinkAgile) XCC
Lenovo HX7530 Appliance (ThinkAgile) XCC
Lenovo ST250 V3 (ThinkSystem) XCC
Lenovo VX3331 Certified Node (ThinkAgile) XCC
Lenovo HX Enclosure Certified Node (ThinkAgile) XCC
Lenovo HX1021 Edge Certified Node 3yr (ThinkAgile) XCC
Lenovo HX1320 Appliance (ThinkAgile) XCC
Lenovo HX1321 Certified Node (ThinkAgile) XCC
Lenovo HX1331 Certified Node (ThinkAgile) XCC
Lenovo HX1520-R Appliance (ThinkAgile) XCC
Lenovo HX1521-R Certified Node (ThinkAgile) XCC
Lenovo HX2320-E Appliance (ThinkAgile) XCC
Lenovo HX2321 Certified Node (ThinkAgile) XCC
Lenovo HX2330 Appliance (ThinkAgile) XCC
Lenovo HX2331 Certified Node (ThinkAgile) XCC
Lenovo HX2720-E Appliance (ThinkAgile) XCC
Lenovo HX3320 Appliance (ThinkAgile) XCC
Lenovo HX3321 Certified Node (ThinkAgile) XCC
Lenovo HX3330 Appliance (ThinkAgile) XCC
Lenovo HX3331 Certified Node (ThinkAgile) XCC
Lenovo HX3331 Node SAP HANA (ThinkAgile) XCC
Lenovo HX3375 Appliance (ThinkAgile) XCC
Lenovo HX3376 Certified Node (ThinkAgile) XCC
Lenovo HX3520-G Appliance (ThinkAgile) XCC
Lenovo HX3521-G Certified Node (ThinkAgile) XCC
Lenovo HX3720 Appliance (ThinkAgile) XCC
Lenovo HX3721 Certified Node (ThinkAgile) XCC
Lenovo HX5520 Appliance (ThinkAgile) XCC
Lenovo HX5520-C Appliance (ThinkAgile) XCC
Lenovo HX5521 Certified Node (ThinkAgile) XCC
Lenovo HX5521-C Certified Node (ThinkAgile) XCC
Lenovo HX5531 Certified Node (ThinkAgile) XCC
Lenovo HX7520 Appliance (ThinkAgile) XCC
Lenovo HX7521 Certified Node (ThinkAgile) XCC
Lenovo HX7530 Appl for SAP HANA (ThinkAgile) XCC
Lenovo HX7531 Certified Node (ThinkAgile) XCC
Lenovo HX7531 Node SAP HANA (ThinkAgile) XCC
Lenovo HX7820 Appliance (ThinkAgile) XCC
Lenovo HX7821 Certified Node (ThinkAgile) XCC
Lenovo MX Edge Appliance - MX1020 (ThinkAgile) XCC
Lenovo MX3330-F All-flash Appliance (ThinkAgile) XCC
Lenovo MX3330-H Hybrid Appliance (ThinkAgile) XCC
Lenovo MX3331-F All-flash Certified node (ThinkAgile) XCC
Lenovo MX3331-H Hybrid Certified node (ThinkAgile) XCC
Lenovo MX3530 F All flash Appliance (ThinkAgile) XCC
Lenovo MX3530-H Hybrid Appliance (ThinkAgile) XCC
Lenovo MX3531 H Hybrid Certified node (ThinkAgile) XCC
Lenovo MX3531-F All-flash Certified node (ThinkAgile) XCC
Lenovo P920 Rack Workstation (ThinkStation) XCC
Lenovo SD530 (ThinkSystem) XCC

Classification

Weakness

CWE-78 Improper Neutralization of Special Elements used in an OS Command

References

support.lenovo.com /us/en/product_security/LEN-172051

Sources

CVE List CVE-2024-8281
NVD CVE-2024-8281

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary