Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2024-8278

Quick assessment

Affected
Lenovo HX5530 Appliance (ThinkAgile) XCC
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Lenovo XClarity Controller（Lenovo XCC）是中国联想（Lenovo）公司的一款服务器嵌入式管理引擎。主要用于标准化和自动化基础服务器管理任务。 Lenovo XClarity Controller存在安全漏洞，该漏洞源于通过特别构造的IPMI命令，可能允许具有提升权限的有效认证XCC用户执行命令注入。

CVSS 7.2 · High EPSS 1.10% · P64
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2024-8278

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
A privilege escalation vulnerability was discovered in XCC that could allow a valid, authenticated XCC user with elevated privileges to perform command injection via specially crafted IPMI commands.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
OS命令中使用的特殊元素转义处理不恰当(OS命令注入)
Source: CVE Program / CVE List V5
Vulnerability Title
Lenovo XClarity Controller 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Lenovo XClarity Controller（Lenovo XCC）是中国联想（Lenovo）公司的一款服务器嵌入式管理引擎。主要用于标准化和自动化基础服务器管理任务。 Lenovo XClarity Controller存在安全漏洞，该漏洞源于通过特别构造的IPMI命令，可能允许具有提升权限的有效认证XCC用户执行命令注入。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Lenovo HX5530 Appliance (ThinkAgile) XCC 0 ~ 4.71 AFBT48C -
Lenovo HX7530 Appliance (ThinkAgile) XCC 0 ~ 4.71 AFBT48C -
Lenovo ST250 V3 (ThinkSystem) XCC 0 ~ 2.10 CTX312G -
Lenovo VX3331 Certified Node (ThinkAgile) XCC 0 ~ 4.71 AFBT48C -
Lenovo HX Enclosure Certified Node (ThinkAgile) XCC 0 ~ 6.36 TEI3F4A -
Lenovo HX1021 Edge Certified Node 3yr (ThinkAgile) XCC 0 ~ 4.11 TEI3E4A -
Lenovo HX1320 Appliance (ThinkAgile) XCC 0 ~ 9.97 CDI3B4B -
Lenovo HX1321 Certified Node (ThinkAgile) XCC 0 ~ 9.97 CDI3B4B -
Lenovo HX1331 Certified Node (ThinkAgile) XCC 0 ~ 4.71 AFBT48C -
Lenovo HX1520-R Appliance (ThinkAgile) XCC 0 ~ 9.97 CDI3B4B -
Lenovo HX1521-R Certified Node (ThinkAgile) XCC 0 ~ 9.97 CDI3B4B -
Lenovo HX2320-E Appliance (ThinkAgile) XCC 0 ~ 9.97 CDI3B4B -
Lenovo HX2321 Certified Node (ThinkAgile) XCC 0 ~ 9.97 CDI3B4B -
Lenovo HX2330 Appliance (ThinkAgile) XCC 0 ~ 4.71 AFBT48C -
Lenovo HX2331 Certified Node (ThinkAgile) XCC 0 ~ 4.71 AFBT48C -
Lenovo HX2720-E Appliance (ThinkAgile) XCC 0 ~ 6.36 TEI3F4A -
Lenovo HX3320 Appliance (ThinkAgile) XCC 0 ~ 9.97 CDI3B4B -
Lenovo HX3321 Certified Node (ThinkAgile) XCC 0 ~ 9.97 CDI3B4B -
Lenovo HX3330 Appliance (ThinkAgile) XCC 0 ~ 4.71 AFBT48C -
Lenovo HX3331 Certified Node (ThinkAgile) XCC 0 ~ 4.71 AFBT48C -
Lenovo HX3331 Node SAP HANA (ThinkAgile) XCC 0 ~ 4.71 AFBT48C -
Lenovo HX3375 Appliance (ThinkAgile) XCC 0 ~ 5.61 D8BT64D -
Lenovo HX3376 Certified Node (ThinkAgile) XCC 0 ~ 5.61 D8BT64D -
Lenovo HX3520-G Appliance (ThinkAgile) XCC 0 ~ 9.97 CDI3B4B -
Lenovo HX3521-G Certified Node (ThinkAgile) XCC 0 ~ 9.97 CDI3B4B -
Lenovo HX3720 Appliance (ThinkAgile) XCC 0 ~ 6.36 TEI3F4A -
Lenovo HX3721 Certified Node (ThinkAgile) XCC 0 ~ 6.36 TEI3F4A -
Lenovo HX5520 Appliance (ThinkAgile) XCC 0 ~ 9.97 CDI3B4B -
Lenovo HX5520-C Appliance (ThinkAgile) XCC 0 ~ 9.97 CDI3B4B -
Lenovo HX5521 Certified Node (ThinkAgile) XCC 0 ~ 9.97 CDI3B4B -

II. Public POCs for CVE-2024-8278

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2024-8278

请登录查看更多情报信息。

Vendor Advisories for CVE-2024-8278 (1)

Same Patch Batch · Lenovo · 2024-09-13 · 12 CVEs total

CVE-2024-8279 7.2 HIGH Lenovo XClarity Controller 安全漏洞
CVE-2024-8280 7.2 HIGH Lenovo XClarity Controller 安全漏洞
CVE-2024-8281 7.2 HIGH Lenovo XClarity Controller 安全漏洞
CVE-2024-7756 6.8 MEDIUM Lenovo ThinkPad 安全漏洞
CVE-2024-45101 6.8 MEDIUM Lenovo XClarity Administrator 安全漏洞
CVE-2024-3100 6.7 MEDIUM Lenovo Notebook 安全漏洞
CVE-2024-4550 6.7 MEDIUM Lenovo ThinkSystem和Lenovo ThinkStation 安全漏洞
CVE-2024-45105 6.7 MEDIUM Lenovo ThinkSystem 安全漏洞
CVE-2024-45104 6.3 MEDIUM Lenovo XClarity Administrator 安全漏洞
CVE-2024-8059 4.3 MEDIUM Lenovo XClarity Controller 安全漏洞
CVE-2024-45103 4.3 MEDIUM Lenovo XClarity Administrator 安全漏洞

IV. Related Vulnerabilities

Same product: HX5530 Appliance (ThinkAgile) XCC
Same vendor: Lenovo
Same weakness: CWE-78

V. Comments for CVE-2024-8278

No comments yet

Leave a comment