Attacker Value
Unknown
(0 users assessed)
Exploitability
Unknown
(0 users assessed)
User Interaction
None
Privileges Required
High
Attack Vector
Network
0

CVE-2024-8278

Disclosure Date: September 13, 2024 •
CVE-2024-8278 CVSS v3 Base Score: 7.2
Add MITRE ATT&CK tactics and techniques that apply to this CVE.

Description

A privilege escalation vulnerability was discovered in XCC that could allow a valid, authenticated XCC user with elevated privileges to perform command injection via specially crafted IPMI commands.

Add Assessment

No one has assessed this topic. Be the first to add your voice to the community.

CVSS V3 Severity and Metrics
Base Score:
7.2 High
Impact Score:
5.9
Exploitability Score:
1.2
Vector:
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Attack Vector (AV):
Network
Attack Complexity (AC):
Low
Privileges Required (PR):
High
User Interaction (UI):
None
Scope (S):
Unchanged
Confidentiality (C):
High
Integrity (I):
High
Availability (A):
High

General Information

Offensive Application
Unknown
Utility Class
Unknown
Ports
Unknown
OS
Unknown
Vulnerable Versions
HX5530 Appliance (ThinkAgile) XCC 4.71 AFBT48C
HX7530 Appliance (ThinkAgile) XCC 4.71 AFBT48C
ST250 V3 (ThinkSystem) XCC 2.10 CTX312G
VX3331 Certified Node (ThinkAgile) XCC 4.71 AFBT48C
HX Enclosure Certified Node (ThinkAgile) XCC 6.36 TEI3F4A
HX1021 Edge Certified Node 3yr (ThinkAgile) XCC 4.11 TEI3E4A
HX1320 Appliance (ThinkAgile) XCC 9.97 CDI3B4B
HX1321 Certified Node (ThinkAgile) XCC 9.97 CDI3B4B
HX1331 Certified Node (ThinkAgile) XCC 4.71 AFBT48C
HX1520-R Appliance (ThinkAgile) XCC 9.97 CDI3B4B
HX1521-R Certified Node (ThinkAgile) XCC 9.97 CDI3B4B
HX2320-E Appliance (ThinkAgile) XCC 9.97 CDI3B4B
HX2321 Certified Node (ThinkAgile) XCC 9.97 CDI3B4B
HX2330 Appliance (ThinkAgile) XCC 4.71 AFBT48C
HX2331 Certified Node (ThinkAgile) XCC 4.71 AFBT48C
HX2720-E Appliance (ThinkAgile) XCC 6.36 TEI3F4A
HX3320 Appliance (ThinkAgile) XCC 9.97 CDI3B4B
HX3321 Certified Node (ThinkAgile) XCC 9.97 CDI3B4B
HX3330 Appliance (ThinkAgile) XCC 4.71 AFBT48C
HX3331 Certified Node (ThinkAgile) XCC 4.71 AFBT48C
HX3331 Node SAP HANA (ThinkAgile) XCC 4.71 AFBT48C
HX3375 Appliance (ThinkAgile) XCC 5.61 D8BT64D
HX3376 Certified Node (ThinkAgile) XCC 5.61 D8BT64D
HX3520-G Appliance (ThinkAgile) XCC 9.97 CDI3B4B
HX3521-G Certified Node (ThinkAgile) XCC 9.97 CDI3B4B
HX3720 Appliance (ThinkAgile) XCC 6.36 TEI3F4A
HX3721 Certified Node (ThinkAgile) XCC 6.36 TEI3F4A
HX5520 Appliance (ThinkAgile) XCC 9.97 CDI3B4B
HX5520-C Appliance (ThinkAgile) XCC 9.97 CDI3B4B
HX5521 Certified Node (ThinkAgile) XCC 9.97 CDI3B4B
HX5521-C Certified Node (ThinkAgile) XCC 9.97 CDI3B4B
HX5531 Certified Node (ThinkAgile) XCC 4.71 AFBT48C
HX7520 Appliance (ThinkAgile) XCC 9.97 CDI3B4B
HX7521 Certified Node (ThinkAgile) XCC 9.97 CDI3B4B
HX7530 Appl for SAP HANA (ThinkAgile) XCC 4.71 AFBT48C
HX7531 Certified Node (ThinkAgile) XCC 4.71 AFBT48C
HX7531 Node SAP HANA (ThinkAgile) XCC 4.71 AFBT48C
HX7820 Appliance (ThinkAgile) XCC 3.11 PSI354A
HX7821 Certified Node (ThinkAgile) XCC 3.11 PSI354A
MX Edge Appliance - MX1020 (ThinkAgile) XCC 4.11 TEI3E4A
MX3330-F All-flash Appliance (ThinkAgile) XCC 4.71 AFBT48C
MX3330-H Hybrid Appliance (ThinkAgile) XCC 4.71 AFBT48C
MX3331-F All-flash Certified node (ThinkAgile) XCC 4.71 AFBT48C
MX3331-H Hybrid Certified node (ThinkAgile) XCC 4.71 AFBT48C
MX3530 F All flash Appliance (ThinkAgile) XCC 4.71 AFBT48C
MX3530-H Hybrid Appliance (ThinkAgile) XCC 4.71 AFBT48C
MX3531 H Hybrid Certified node (ThinkAgile) XCC 4.71 AFBT48C
MX3531-F All-flash Certified node (ThinkAgile) XCC 4.71 AFBT48C
P920 Rack Workstation (ThinkStation) XCC 9.97 CDI3B4B
SD530 (ThinkSystem) XCC 6.36 TEI3F4A
SD530 V3 (ThinkSystem) XCC 1.20 USX352
SD550 V3 (ThinkSystem) XCC 1.20 USX352
SD630 V2 (ThinkSystem) XCC 4.11 TGBT50C
SD650 DWC Dual Node Tray (ThinkSystem) XCC 6.36 TEI3F4A
SD650 V2 (ThinkSystem) XCC 4.11 TGBT50C
SD650 V3 (ThinkSystem) XCC 6.10 USX350G
SD650-N V2 (ThinkSystem) XCC 4.11 TGBT50C
SD665 V3 (ThinkSystem) XCC 6.10 QGX340J
SE350 (ThinkSystem) XCC 4.11 TEI3E4A
SE350 V2 (ThinkEdge) XCC 3.11 IYX328M
SE360 V2 (ThinkEdge) XCC 3.11 IYX328M
SE450 (ThinkEdge) XCC 3.11 USX332X
SE455 V3 (ThinkEdge) XCC 3.10 MBX308L
SN550 (ThinkSystem) XCC 6.36 TEI3F4A
SN550 V2 (ThinkSystem) XCC 4.11 TGBT50C
SN850 (ThinkSystem) XCC 6.36 TEI3F4A
SR150 (ThinkSystem) XCC 6.36 TEI3F4A
SR158 (ThinkSystem) XCC 6.36 TEI3F4A
SR250 (ThinkSystem) XCC 6.36 TEI3F4A
SR250 V2 (ThinkSystem) XCC 4.11 TGBT50C
SR250 V3 (ThinkSystem) XCC 2.10 CTX312G
SR258 (ThinkSystem) XCC 6.36 TEI3F4A
SR258 V2 (ThinkSystem) XCC 4.11 TGBT50C
SR258 V3 (ThinkSystem) XCC 2.10 CTX312G
SR530 (ThinkSystem) XCC 9.97 CDI3B4B
SR550 (ThinkSystem) XCC 9.97 CDI3B4B
SR570 (ThinkSystem) XCC 9.97 CDI3B4B
SR590 (ThinkSystem) XCC 9.97 CDI3B4B
SR630 (ThinkSystem) XCC 9.97 CDI3B4B
SR630 V2 (ThinkSystem) XCC 4.71 AFBT48C
SR630 V3 (ThinkSystem) XCC 5.10 ESX330M
SR635 V3 (ThinkSystem) XCC 3.20 KAX334O
SR645 (ThinkSystem) XCC 5.61 D8BT64D
SR645 V3 (ThinkSystem) XCC 3.20 KAX334O
SR650 (ThinkSystem) XCC 9.97 CDI3B4B
SR650 V2 (ThinkSystem) XCC 4.71 AFBT48C
SR650 V3 (ThinkSystem) XCC 5.10 ESX330M
SR655 V3 (ThinkSystem) XCC 3.20 KAX334O
SR665 (ThinkSystem) XCC 5.61 D8BT64D
SR665 V3 (ThinkSystem) XCC 3.20 KAX334O
SR670 (ThinkSystem) XCC 4.11 TEI3E4A
SR670 V2 (ThinkSystem) XCC 4.11 TGBT50C
SR675 V3 (ThinkSystem) XCC 6.10 QGX340J
SR850 (ThinkSystem) XCC 6.36 TEI3F4A
SR850 V2 (ThinkSystem) XCC 4.11 TGBT50C
SR850 V3 (ThinkSystem) XCC 4.10 RSX312I
SR850P (ThinkSystem) XCC 4.11 TEI3E4A
SR860 (ThinkSystem) XCC 6.36 TEI3F4A
SR860 V2 (ThinkSystem) XCC 4.11 TGBT50C
SR860 V3 (ThinkSystem) XCC 4.10 RSX312I
SR950 (ThinkSystem) XCC 3.11 PSI354A
SR950 V3 (ThinkSystem) XCC 3.10 EBX308I
ST250 (ThinkSystem) XCC 6.36 TEI3F4A
ST250 V2 (ThinkSystem) XCC 4.11 TGBT50C
ST258 (ThinkSystem) XCC 6.36 TEI3F4A
ST258 V2 (ThinkSystem) XCC 4.11 TGBT50C
ST258 V3 (ThinkSystem) XCC 2.10 CTX312G
ST550 (ThinkSystem) XCC 9.97 CDI3B4B
ST650 V2 (ThinkSystem) XCC 4.11 TGBT50C
ST650 V3 (ThinkSystem) XCC 6.10 USX350G
ST658 V2 (ThinkSystem) XCC 4.11 TGBT50C
ST658 V3 (ThinkSystem) XCC 6.10 USX350G
ThinkAgile MX1021 on SE350 XCC 4.11 TEI3E4A
VX 1SE Certified Node (ThinkAgile) XCC 6.36 TEI3F4A
VX 2U4N Certified Node (ThinkAgile) XCC 6.36 TEI3F4A
VX 4U Certified Node (ThinkAgile) XCC 3.11 PSI354A
VX1320 (ThinkAgile) XCC 6.36 TEI3F4A
VX2320 (ThinkAgile) XCC 9.97 CDI3B4B
VX2330 Appliance (ThinkAgile) XCC 4.71 AFBT48C
VX3320 (ThinkAgile) XCC 9.97 CDI3B4B
VX3330 Appliance (ThinkAgile) XCC 4.71 AFBT48C
VX3520-G (ThinkAgile) XCC 9.97 CDI3B4B
VX3530-G Appliance (ThinkAgile) XCC 4.71 AFBT48C
VX3720 (ThinkAgile) XCC 6.36 TEI3F4A
VX5520 (ThinkAgile) XCC 9.97 CDI3B4B
VX5530 Appliance (ThinkAgile) XCC 4.71 AFBT48C
VX635 V3 Integrated System (ThinkAgile) XCC 3.20 KAX334O
VX645 V3 Certified Node (ThinkAgile) XCC 3.20 KAX334O
VX645 V3 Integrated System (ThinkAgile) XCC 3.20 KAX334O
VX655 V3 Certified Node (ThinkAgile) XCC 3.20 KAX334O
VX655 V3 Integrated System (ThinkAgile) XCC 3.20 KAX334O
VX665 V3 Certified Node (ThinkAgile) XCC 3.20 KAX334O
VX665 V3 Integrated System (ThinkAgile) XCC 3.20 KAX334O
VX7320 N (ThinkAgile) XCC 9.97 CDI3B4B
VX7330 Appliance (Thinkagile) XCC 4.71 AFBT48C
VX7520 (ThinkAgile) XCC 9.97 CDI3B4B
VX7520 N (ThinkAgile) XCC 9.97 CDI3B4B
VX7530 Appliance (ThinkAgile) XCC 4.71 AFBT48C
VX7531 Certified Node (ThinkAgile) XCC 4.71 AFBT48C
VX7820 (ThinkAgile) XCC 3.11 PSI354A
Prerequisites
Unknown
Discovered By
Unknown
PoC Author
Unknown
Metasploit Module
Unknown
Reporter
Unknown

Vendors

  • Lenovo

Products

  • HX5530 Appliance (ThinkAgile) XCC,
  • HX7530 Appliance (ThinkAgile) XCC,
  • ST250 V3 (ThinkSystem) XCC,
  • VX3331 Certified Node (ThinkAgile) XCC,
  • HX Enclosure Certified Node (ThinkAgile) XCC,
  • HX1021 Edge Certified Node 3yr (ThinkAgile) XCC,
  • HX1320 Appliance (ThinkAgile) XCC,
  • HX1321 Certified Node (ThinkAgile) XCC,
  • HX1331 Certified Node (ThinkAgile) XCC,
  • HX1520-R Appliance (ThinkAgile) XCC,
  • HX1521-R Certified Node (ThinkAgile) XCC,
  • HX2320-E Appliance (ThinkAgile) XCC,
  • HX2321 Certified Node (ThinkAgile) XCC,
  • HX2330 Appliance (ThinkAgile) XCC,
  • HX2331 Certified Node (ThinkAgile) XCC,
  • HX2720-E Appliance (ThinkAgile) XCC,
  • HX3320 Appliance (ThinkAgile) XCC,
  • HX3321 Certified Node (ThinkAgile) XCC,
  • HX3330 Appliance (ThinkAgile) XCC,
  • HX3331 Certified Node (ThinkAgile) XCC,
  • HX3331 Node SAP HANA (ThinkAgile) XCC,
  • HX3375 Appliance (ThinkAgile) XCC,
  • HX3376 Certified Node (ThinkAgile) XCC,
  • HX3520-G Appliance (ThinkAgile) XCC,
  • HX3521-G Certified Node (ThinkAgile) XCC,
  • HX3720 Appliance (ThinkAgile) XCC,
  • HX3721 Certified Node (ThinkAgile) XCC,
  • HX5520 Appliance (ThinkAgile) XCC,
  • HX5520-C Appliance (ThinkAgile) XCC,
  • HX5521 Certified Node (ThinkAgile) XCC,
  • HX5521-C Certified Node (ThinkAgile) XCC,
  • HX5531 Certified Node (ThinkAgile) XCC,
  • HX7520 Appliance (ThinkAgile) XCC,
  • HX7521 Certified Node (ThinkAgile) XCC,
  • HX7530 Appl for SAP HANA (ThinkAgile) XCC,
  • HX7531 Certified Node (ThinkAgile) XCC,
  • HX7531 Node SAP HANA (ThinkAgile) XCC,
  • HX7820 Appliance (ThinkAgile) XCC,
  • HX7821 Certified Node (ThinkAgile) XCC,
  • MX Edge Appliance - MX1020 (ThinkAgile) XCC,
  • MX3330-F All-flash Appliance (ThinkAgile) XCC,
  • MX3330-H Hybrid Appliance (ThinkAgile) XCC,
  • MX3331-F All-flash Certified node (ThinkAgile) XCC,
  • MX3331-H Hybrid Certified node (ThinkAgile) XCC,
  • MX3530 F All flash Appliance (ThinkAgile) XCC,
  • MX3530-H Hybrid Appliance (ThinkAgile) XCC,
  • MX3531 H Hybrid Certified node (ThinkAgile) XCC,
  • MX3531-F All-flash Certified node (ThinkAgile) XCC,
  • P920 Rack Workstation (ThinkStation) XCC,
  • SD530 (ThinkSystem) XCC,
  • SD530 V3 (ThinkSystem) XCC,
  • SD550 V3 (ThinkSystem) XCC,
  • SD630 V2 (ThinkSystem) XCC,
  • SD650 DWC Dual Node Tray (ThinkSystem) XCC,
  • SD650 V2 (ThinkSystem) XCC,
  • SD650 V3 (ThinkSystem) XCC,
  • SD650-N V2 (ThinkSystem) XCC,
  • SD665 V3 (ThinkSystem) XCC,
  • SE350 (ThinkSystem) XCC,
  • SE350 V2 (ThinkEdge) XCC,
  • SE360 V2 (ThinkEdge) XCC,
  • SE450 (ThinkEdge) XCC,
  • SE455 V3 (ThinkEdge) XCC,
  • SN550 (ThinkSystem) XCC,
  • SN550 V2 (ThinkSystem) XCC,
  • SN850 (ThinkSystem) XCC,
  • SR150 (ThinkSystem) XCC,
  • SR158 (ThinkSystem) XCC,
  • SR250 (ThinkSystem) XCC,
  • SR250 V2 (ThinkSystem) XCC,
  • SR250 V3 (ThinkSystem) XCC,
  • SR258 (ThinkSystem) XCC,
  • SR258 V2 (ThinkSystem) XCC,
  • SR258 V3 (ThinkSystem) XCC,
  • SR530 (ThinkSystem) XCC,
  • SR550 (ThinkSystem) XCC,
  • SR570 (ThinkSystem) XCC,
  • SR590 (ThinkSystem) XCC,
  • SR630 (ThinkSystem) XCC,
  • SR630 V2 (ThinkSystem) XCC,
  • SR630 V3 (ThinkSystem) XCC,
  • SR635 V3 (ThinkSystem) XCC,
  • SR645 (ThinkSystem) XCC,
  • SR645 V3 (ThinkSystem) XCC,
  • SR650 (ThinkSystem) XCC,
  • SR650 V2 (ThinkSystem) XCC,
  • SR650 V3 (ThinkSystem) XCC,
  • SR655 V3 (ThinkSystem) XCC,
  • SR665 (ThinkSystem) XCC,
  • SR665 V3 (ThinkSystem) XCC,
  • SR670 (ThinkSystem) XCC,
  • SR670 V2 (ThinkSystem) XCC,
  • SR675 V3 (ThinkSystem) XCC,
  • SR850 (ThinkSystem) XCC,
  • SR850 V2 (ThinkSystem) XCC,
  • SR850 V3 (ThinkSystem) XCC,
  • SR850P (ThinkSystem) XCC,
  • SR860 (ThinkSystem) XCC,
  • SR860 V2 (ThinkSystem) XCC,
  • SR860 V3 (ThinkSystem) XCC,
  • SR950 (ThinkSystem) XCC,
  • SR950 V3 (ThinkSystem) XCC,
  • ST250 (ThinkSystem) XCC,
  • ST250 V2 (ThinkSystem) XCC,
  • ST258 (ThinkSystem) XCC,
  • ST258 V2 (ThinkSystem) XCC,
  • ST258 V3 (ThinkSystem) XCC,
  • ST550 (ThinkSystem) XCC,
  • ST650 V2 (ThinkSystem) XCC,
  • ST650 V3 (ThinkSystem) XCC,
  • ST658 V2 (ThinkSystem) XCC,
  • ST658 V3 (ThinkSystem) XCC,
  • ThinkAgile MX1021 on SE350 XCC,
  • VX 1SE Certified Node (ThinkAgile) XCC,
  • VX 2U4N Certified Node (ThinkAgile) XCC,
  • VX 4U Certified Node (ThinkAgile) XCC,
  • VX1320 (ThinkAgile) XCC,
  • VX2320 (ThinkAgile) XCC,
  • VX2330 Appliance (ThinkAgile) XCC,
  • VX3320 (ThinkAgile) XCC,
  • VX3330 Appliance (ThinkAgile) XCC,
  • VX3520-G (ThinkAgile) XCC,
  • VX3530-G Appliance (ThinkAgile) XCC,
  • VX3720 (ThinkAgile) XCC,
  • VX5520 (ThinkAgile) XCC,
  • VX5530 Appliance (ThinkAgile) XCC,
  • VX635 V3 Integrated System (ThinkAgile) XCC,
  • VX645 V3 Certified Node (ThinkAgile) XCC,
  • VX645 V3 Integrated System (ThinkAgile) XCC,
  • VX655 V3 Certified Node (ThinkAgile) XCC,
  • VX655 V3 Integrated System (ThinkAgile) XCC,
  • VX665 V3 Certified Node (ThinkAgile) XCC,
  • VX665 V3 Integrated System (ThinkAgile) XCC,
  • VX7320 N (ThinkAgile) XCC,
  • VX7330 Appliance (Thinkagile) XCC,
  • VX7520 (ThinkAgile) XCC,
  • VX7520 N (ThinkAgile) XCC,
  • VX7530 Appliance (ThinkAgile) XCC,
  • VX7531 Certified Node (ThinkAgile) XCC,
  • VX7820 (ThinkAgile) XCC

Additional Info

Authenticated
Unknown
Exploitable
Unknown
Reliability
Unknown
Stability
Unknown
Available Mitigations
Unknown
Shelf Life
Unknown
Userbase/Installbase
Unknown
Patch Effectiveness
Unknown
Technical Analysis