Command Injection Vulnerability in XCC SSH Captive Shell

CVE-2024-8281

7.2HIGH

Key Information

Vendor
Lenovo
Status
Hx5530 Appliance (thinkagile) Xcc
Hx7530 Appliance (thinkagile) Xcc
St250 V3 (thinksystem) Xcc
Vx3331 Certified Node (thinkagile) Xcc
Vendor
CVE Published:
13 September 2024

Summary

An input validation weakness was discovered in XCC that could allow a valid, authenticated XCC user with elevated privileges to perform command injection through specially crafted command line input in the XCC SSH captive shell.

Affected Version(s)

HX5530 Appliance (ThinkAgile) XCC < 4.71 AFBT48C

HX7530 Appliance (ThinkAgile) XCC < 4.71 AFBT48C

ST250 V3 (ThinkSystem) XCC < 2.10 CTX312G

References

https://support.lenovo.com/us/en/product_security/LEN-172051

CVSS V3.1

Score:
7.2
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Collectors

NVD DatabaseMitre Database
.