XCC Input Validation Weakness Could Lead to Command Injection or Denial of Service
CVE-2024-8280
Key Information:
- Vendor
Lenovo
- Status
- Vendor
- CVE Published:
- 13 September 2024
What is CVE-2024-8280?
An input validation weakness has been identified in Lenovo's XCC, which may allow an authenticated user with elevated privileges to exploit this vulnerability. By using a specially crafted file, it is possible to perform command injection attacks, potentially leading to unauthorized command execution. Additionally, this vulnerability could result in a recoverable denial of service, impacting the overall stability and performance of affected systems. Users of XCC are advised to review their configurations and apply necessary mitigations as outlined in Lenovo's security advisories.
Affected Version(s)
HX Enclosure Certified Node (ThinkAgile) XCC 0 < 6.36 TEI3F4A
HX1021 Edge Certified Node 3yr (ThinkAgile) XCC 0 < 4.11 TEI3E4A
HX1320 Appliance (ThinkAgile) XCC 0 < 9.97 CDI3B4B