Command Injection Vulnerability in XCC SSH Captive Shell
CVE-2024-8281

7.2HIGH

Key Information:

Vendor

Lenovo
Status
Hx5530 Appliance (thinkagile) Xcc
Hx7530 Appliance (thinkagile) Xcc
St250 V3 (thinksystem) Xcc
Vx3331 Certified Node (thinkagile) Xcc
Vendor
CVE Published:
13 September 2024

What is CVE-2024-8281?

An input validation weakness has been identified in Lenovo's XCC that could potentially allow authenticated users with elevated privileges to execute command injection attacks through carefully constructed command line inputs in the XCC SSH captive shell. This vulnerability poses a significant risk to the integrity and security of affected systems, requiring immediate remediation efforts to protect sensitive environments and data from exploitation.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

HX Enclosure Certified Node (ThinkAgile) XCC 0 < 6.36 TEI3F4A

HX1021 Edge Certified Node 3yr (ThinkAgile) XCC 0 < 4.11 TEI3E4A

HX1320 Appliance (ThinkAgile) XCC 0 < 9.97 CDI3B4B

References

https://support.lenovo.com/us/en/product_security/LEN-172051

CVSS V3.1

Score:
7.2
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.