SQL injection in Lenovo XClarity Controller
Priority LOW 32CWE-89Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- None
- Attack complexity
- Low
- Impact type
- SQL injection
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-89.
Summary
An authenticated XCC user with elevated privileges can perform blind SQL injection in limited cases through a crafted API command. This affects ThinkSystem v2 and v3 servers with XCC; ThinkSystem v1 servers are not affected.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00405 35th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Lenovo | Lenovo XClarity Controller (XCC) | various | — | No fix listed | CNA |
- Lenovo XClarity Controller (XCC) VendorLenovo Affected various Fixed in — No fix listed CNA
CPE configurations NVD · 104
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:lenovo:thinkagile_hx5530_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:thinkagile_hx5530:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:o:lenovo:thinkagile_hx7530_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:thinkagile_hx7530:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:o:lenovo:thinkagile_vx3331_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:thinkagile_vx3331:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:o:lenovo:thinkagile_hx1331_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:thinkagile_hx1331:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:o:lenovo:thinkagile_hx2330_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:thinkagile_hx2330:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
- cpe:2.3:o:lenovo:thinkagile_hx5530_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:thinkagile_hx5530:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:o:lenovo:thinkagile_hx7530_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:thinkagile_hx7530:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:o:lenovo:thinkagile_vx3331_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:thinkagile_vx3331:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:o:lenovo:thinkagile_hx1331_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:thinkagile_hx1331:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:o:lenovo:thinkagile_hx2330_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:thinkagile_hx2330:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
Show 94 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:lenovo:thinkagile_hx2331_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:thinkagile_hx2331:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:o:lenovo:thinkagile_hx3330_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:thinkagile_hx3330:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:o:lenovo:thinkagile_hx3331_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:thinkagile_hx3331:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:o:lenovo:thinkagile_hx3375_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:thinkagile_hx3375:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:o:lenovo:thinkagile_hx3376_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:thinkagile_hx3376:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:o:lenovo:thinkagile_hx5531_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:thinkagile_hx5531:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:o:lenovo:thinkagile_hx7531_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:thinkagile_hx7531:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:o:lenovo:thinkagile_mx3330-f_all-flash_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:thinkagile_mx3330-f_all-flash:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:o:lenovo:thinkagile_mx3330-h_hybrid_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:thinkagile_mx3330-h_hybrid:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:o:lenovo:thinkagile_mx3331-f_all-flash_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:thinkagile_mx3331-f_all-flash:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:o:lenovo:thinkagile_mx3331-h_hybrid_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:thinkagile_mx3331-h_hybrid:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:o:lenovo:thinkagile_mx3530_f_all_flash_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:thinkagile_mx3530_f_all_flash:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:o:lenovo:thinkagile_mx3530-h_hybrid_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:thinkagile_mx3530-h_hybrid:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:o:lenovo:thinkagile_mx3531_h_hybrid_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:thinkagile_mx3531_h_hybrid:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:o:lenovo:thinkagile_mx3531-f_all-flash_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:thinkagile_mx3531-f_all-flash:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:o:lenovo:thinkagile_vx2330_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:thinkagile_vx2330:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:o:lenovo:thinkagile_vx3330_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:thinkagile_vx3330:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:o:lenovo:thinkagile_vx3530-g_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:thinkagile_vx3530-g:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:o:lenovo:thinkagile_vx5530_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:thinkagile_vx5530:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:o:lenovo:thinkagile_vx7330_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:thinkagile_vx7330:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:o:lenovo:thinkagile_vx7530_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:thinkagile_vx7530:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:o:lenovo:thinkagile_vx7531_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:thinkagile_vx7531:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:o:lenovo:thinksystem_sd630_v2_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:thinksystem_sd630_v2:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:o:lenovo:thinksystem_sd650_v2_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:thinksystem_sd650_v2:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:o:lenovo:thinksystem_sd650_v3_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Lenovo |
| cpe:2.3:o:lenovo:thinksystem_sd650-n_v2_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:thinksystem_sd650-n_v2:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:o:lenovo:thinksystem_sd665_v3_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Lenovo |
| cpe:2.3:o:lenovo:thinksystem_sn550_v2_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:thinksystem_sn550_v2:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:o:lenovo:thinksystem_sr250_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:thinksystem_sr250_v2:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:o:lenovo:thinksystem_sr258_v2_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:thinksystem_sr258_v2:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:o:lenovo:thinksystem_sr630_v2_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:thinksystem_sr630_v2:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:o:lenovo:thinksystem_sr630_v3_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Lenovo |
| cpe:2.3:o:lenovo:thinksystem_sr635_v3_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Lenovo |
| cpe:2.3:o:lenovo:thinksystem_sr645_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:thinksystem_sr645:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:o:lenovo:thinksystem_sr645_v3_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:thinksystem_sr645_v3:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:o:lenovo:thinksystem_sr650_v2_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:thinksystem_sr650_v2:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:o:lenovo:thinksystem_sr650_v3_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Lenovo |
| cpe:2.3:o:lenovo:thinksystem_sr655_v3_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Lenovo |
| cpe:2.3:o:lenovo:thinksystem_sr665_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:thinksystem_sr665:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:o:lenovo:thinksystem_sr665_v3_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Lenovo |
| cpe:2.3:o:lenovo:thinksystem_sr670_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:thinksystem_sr670:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:o:lenovo:thinksystem_sr670_v2_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:thinksystem_sr670_v2:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:o:lenovo:thinksystem_sr675_v3_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Lenovo |
| cpe:2.3:o:lenovo:thinksystem_sr850_v2_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:thinksystem_sr850_v2:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:o:lenovo:thinksystem_sr850_v3_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Lenovo |
| cpe:2.3:o:lenovo:thinksystem_sr860_v2_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:thinksystem_sr860_v2:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:o:lenovo:thinksystem_sr860_v3_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Lenovo |
| cpe:2.3:o:lenovo:thinksystem_st250_v2_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:thinksystem_st250_v2:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:o:lenovo:thinksystem_st258_v2_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:thinksystem_st258_v2:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:o:lenovo:thinksystem_st650_v2_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:thinksystem_st650_v2:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:o:lenovo:thinksystem_st650_v3_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Lenovo |
| cpe:2.3:o:lenovo:thinksystem_st658_v2_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:thinksystem_st658_v2:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:o:lenovo:thinksystem_st658_v3_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Lenovo |
- cpe:2.3:o:lenovo:thinkagile_hx2331_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:thinkagile_hx2331:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:o:lenovo:thinkagile_hx3330_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:thinkagile_hx3330:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:o:lenovo:thinkagile_hx3331_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:thinkagile_hx3331:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:o:lenovo:thinkagile_hx3375_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:thinkagile_hx3375:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:o:lenovo:thinkagile_hx3376_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:thinkagile_hx3376:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:o:lenovo:thinkagile_hx5531_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:thinkagile_hx5531:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:o:lenovo:thinkagile_hx7531_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:thinkagile_hx7531:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:o:lenovo:thinkagile_mx3330-f_all-flash_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:thinkagile_mx3330-f_all-flash:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:o:lenovo:thinkagile_mx3330-h_hybrid_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:thinkagile_mx3330-h_hybrid:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:o:lenovo:thinkagile_mx3331-f_all-flash_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:thinkagile_mx3331-f_all-flash:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:o:lenovo:thinkagile_mx3331-h_hybrid_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:thinkagile_mx3331-h_hybrid:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:o:lenovo:thinkagile_mx3530_f_all_flash_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:thinkagile_mx3530_f_all_flash:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:o:lenovo:thinkagile_mx3530-h_hybrid_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:thinkagile_mx3530-h_hybrid:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:o:lenovo:thinkagile_mx3531_h_hybrid_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:thinkagile_mx3531_h_hybrid:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:o:lenovo:thinkagile_mx3531-f_all-flash_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:thinkagile_mx3531-f_all-flash:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:o:lenovo:thinkagile_vx2330_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:thinkagile_vx2330:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:o:lenovo:thinkagile_vx3330_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:thinkagile_vx3330:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:o:lenovo:thinkagile_vx3530-g_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:thinkagile_vx3530-g:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:o:lenovo:thinkagile_vx5530_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:thinkagile_vx5530:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:o:lenovo:thinkagile_vx7330_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:thinkagile_vx7330:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:o:lenovo:thinkagile_vx7530_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:thinkagile_vx7530:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:o:lenovo:thinkagile_vx7531_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:thinkagile_vx7531:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:o:lenovo:thinksystem_sd630_v2_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:thinksystem_sd630_v2:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:o:lenovo:thinksystem_sd650_v2_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:thinksystem_sd650_v2:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:o:lenovo:thinksystem_sd650_v3_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Lenovo
- cpe:2.3:o:lenovo:thinksystem_sd650-n_v2_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:thinksystem_sd650-n_v2:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:o:lenovo:thinksystem_sd665_v3_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Lenovo
- cpe:2.3:o:lenovo:thinksystem_sn550_v2_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:thinksystem_sn550_v2:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:o:lenovo:thinksystem_sr250_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:thinksystem_sr250_v2:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:o:lenovo:thinksystem_sr258_v2_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:thinksystem_sr258_v2:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:o:lenovo:thinksystem_sr630_v2_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:thinksystem_sr630_v2:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:o:lenovo:thinksystem_sr630_v3_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Lenovo
- cpe:2.3:o:lenovo:thinksystem_sr635_v3_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Lenovo
- cpe:2.3:o:lenovo:thinksystem_sr645_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:thinksystem_sr645:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:o:lenovo:thinksystem_sr645_v3_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:thinksystem_sr645_v3:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:o:lenovo:thinksystem_sr650_v2_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:thinksystem_sr650_v2:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:o:lenovo:thinksystem_sr650_v3_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Lenovo
- cpe:2.3:o:lenovo:thinksystem_sr655_v3_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Lenovo
- cpe:2.3:o:lenovo:thinksystem_sr665_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:thinksystem_sr665:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:o:lenovo:thinksystem_sr665_v3_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Lenovo
- cpe:2.3:o:lenovo:thinksystem_sr670_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:thinksystem_sr670:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:o:lenovo:thinksystem_sr670_v2_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:thinksystem_sr670_v2:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:o:lenovo:thinksystem_sr675_v3_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Lenovo
- cpe:2.3:o:lenovo:thinksystem_sr850_v2_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:thinksystem_sr850_v2:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:o:lenovo:thinksystem_sr850_v3_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Lenovo
- cpe:2.3:o:lenovo:thinksystem_sr860_v2_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:thinksystem_sr860_v2:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:o:lenovo:thinksystem_sr860_v3_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Lenovo
- cpe:2.3:o:lenovo:thinksystem_st250_v2_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:thinksystem_st250_v2:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:o:lenovo:thinksystem_st258_v2_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:thinksystem_st258_v2:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:o:lenovo:thinksystem_st650_v2_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:thinksystem_st650_v2:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:o:lenovo:thinksystem_st650_v3_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Lenovo
- cpe:2.3:o:lenovo:thinksystem_st658_v2_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:thinksystem_st658_v2:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:o:lenovo:thinksystem_st658_v3_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Lenovo
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2023-4608
- 2026-10-03 Alias added: GHSA-96gf-qq25-2c24
References
More Lenovo Thinkagile Hx1331 Firmware vulnerabilities
- TI-2023-13507 Incorrect default permissions in Lenovo XClarity Controller CVSS 3.1HIGH 8.8
- TI-2023-04251 An authenticated XCC user can change permissions for any user through a crafted API command. CVSS 3.1HIGH 8.8
- TI-2023-10802 A valid, authenticated user may be able to trigger a denial of service of the XCC web… CVSS 3.1HIGH 8.8
- TI-2023-00645 Improper input validation in Lenovo XClarity Controller CVSS 3.1HIGH 8.8
- TI-2024-02474 OS command injection in Lenovo SMM, SMM2, FPC CVSS 3.1HIGH 7.2
- TI-2023-04250 Missing authorization in Lenovo XClarity Controller CVSS 3.1HIGH 8.1
Sources
- CVE-2023-4608 · CVE Program
- CVE-2023-4608 · NVD
- FIRST EPSS
- GHSA-96gf-qq25-2c24 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences