CVE-2022-34884

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-01-30 · updated 2026-06-17
Weakness: CWE-121

Description

A buffer overflow exists in the Remote Presence subsystem which can potentially allow valid, authenticated users to cause a recoverable subsystem denial of service.

Affected products

Lenovo Thinkagile Hx1021 Firmware: before 3.60_tei386m — fixed in 3.60_tei386m
Lenovo Thinkagile Hx1320 Firmware: before 8.40-cdi394n — fixed in 8.40-cdi394n
Lenovo Thinkagile Hx1321 Firmware: before 8.40-cdi394n — fixed in 8.40-cdi394n
Lenovo Thinkagile Hx1520-R Firmware: before 8.40-cdi394n — fixed in 8.40-cdi394n
Lenovo Thinkagile Hx1521-R Firmware: before 8.40-cdi394n — fixed in 8.40-cdi394n
Lenovo Thinkagile Hx2320-E Firmware: before 8.40-cdi394n — fixed in 8.40-cdi394n
Lenovo Thinkagile Hx2321 Firmware: before 8.40-cdi394n — fixed in 8.40-cdi394n
Lenovo Thinkagile Hx2720-E Firmware: before 5.20_tei3c8m — fixed in 5.20_tei3c8m
Lenovo Thinkagile Hx3320 Firmware: before 8.40-cdi394n — fixed in 8.40-cdi394n
Lenovo Thinkagile Hx3321 Firmware: before 8.40-cdi394n — fixed in 8.40-cdi394n
Lenovo Thinkagile Hx3375 Firmware: before 4.10_d8bt38l — fixed in 4.10_d8bt38l
Lenovo Thinkagile Hx3376 Firmware: before 4.10_d8bt38l — fixed in 4.10_d8bt38l
Lenovo Thinkagile Hx3520-G Firmware: before 8.40-cdi394n — fixed in 8.40-cdi394n
Lenovo Thinkagile Hx3521-G Firmware: before 8.40-cdi394n — fixed in 8.40-cdi394n
Lenovo Thinkagile Hx3720 Firmware: before 5.20_tei3c8m — fixed in 5.20_tei3c8m
Lenovo Thinkagile Hx3721 Firmware: before 5.20_tei3c8m — fixed in 5.20_tei3c8m
Lenovo Thinkagile Hx5520-C Firmware: before 8.40-cdi394n — fixed in 8.40-cdi394n
Lenovo Thinkagile Hx5520 Firmware: before 8.40-cdi394n — fixed in 8.40-cdi394n
Lenovo Thinkagile Hx5521-C Firmware: before 8.40-cdi394n — fixed in 8.40-cdi394n
Lenovo Thinkagile Hx5521 Firmware: before 8.40-cdi394n — fixed in 8.40-cdi394n
Lenovo Thinkagile Hx7520 Firmware: before 8.40-cdi394n — fixed in 8.40-cdi394n
Lenovo Thinkagile Hx7521 Firmware: before 8.40-cdi394n — fixed in 8.40-cdi394n
Lenovo Thinkagile Hx7820 Firmware: before 2.50_psi346l — fixed in 2.50_psi346l
Lenovo Thinkagile Hx7821 Firmware: before 2.50_psi346l — fixed in 2.50_psi346l
Lenovo Thinkagile Hx Enclosure Certified Node Firmware: before 5.20_tei3c8m — fixed in 5.20_tei3c8m
Lenovo Thinkagile Mx1020 Firmware: through 3.60_tei386m
Lenovo Thinkagile Mx1021 Firmware: before 3.60_tei386m — fixed in 3.60_tei386m
Lenovo Thinkagile Mx3330-F Firmware: before 1.80_afbt20n — fixed in 1.80_afbt20n
Lenovo Thinkagile Mx3330-H Firmware: before 1.80_afbt20n — fixed in 1.80_afbt20n
Lenovo Thinkagile Mx3331-F Firmware: before 1.80_afbt20n — fixed in 1.80_afbt20n

How to fix

Upgrade to a fixed version: Lenovo Thinkagile Hx1021 Firmware 3.60_tei386m; Lenovo Thinkagile Hx1320 Firmware 8.40-cdi394n; Lenovo Thinkagile Hx1321 Firmware 8.40-cdi394n; Lenovo Thinkagile Hx1520-R Firmware 8.40-cdi394n; Lenovo Thinkagile Hx1521-R Firmware 8.40-cdi394n; Lenovo Thinkagile Hx2320-E Firmware 8.40-cdi394n; Lenovo Thinkagile Hx2321 Firmware 8.40-cdi394n; Lenovo Thinkagile Hx2720-E Firmware 5.20_tei3c8m; Lenovo Thinkagile Hx3320 Firmware 8.40-cdi394n; Lenovo Thinkagile Hx3321 Firmware 8.40-cdi394n; Lenovo Thinkagile Hx3375 Firmware 4.10_d8bt38l; Lenovo Thinkagile Hx3376 Firmware 4.10_d8bt38l. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2022-34884 or the next vulnerability affects your stack