Possible Command Injection Vulnerability in XCC IPMI
CVE-2024-8278
7.2HIGH
Key Information:
- Vendor
- Lenovo
- Status
- Vendor
- CVE Published:
- 13 September 2024
Summary
A privilege escalation vulnerability has been identified in Lenovo's XCC product, allowing authenticated users with elevated privileges to execute command injection. This security flaw is exploited through specially crafted IPMI commands, potentially compromising system integrity and confidentiality. Organizations using affected versions of XCC are advised to review their security measures and apply any available patches or updates to mitigate the risks associated with this vulnerability.
Affected Version(s)
HX Enclosure Certified Node (ThinkAgile) XCC 0 < 6.36 TEI3F4A
HX1021 Edge Certified Node 3yr (ThinkAgile) XCC 0 < 4.11 TEI3E4A
HX1320 Appliance (ThinkAgile) XCC 0 < 9.97 CDI3B4B
References
CVSS V3.1
Score:
7.2
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged
Timeline
Vulnerability published
Vulnerability Reserved