CVE-2022-34888

Severity: medium (CVSS 4.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-01-30 · updated 2026-06-17
Weakness: CWE-184

Description

The Remote Mount feature can potentially be abused by valid, authenticated users to make connections to internal services that may not normally be accessible to users. Internal service access controls, as applicable, remain in effect.

Affected products

Lenovo Thinkagile Hx1021 Firmware: before 3.60_tei386m — fixed in 3.60_tei386m
Lenovo Thinkagile Hx1320 Firmware: before 8.40-cdi394n — fixed in 8.40-cdi394n
Lenovo Thinkagile Hx1321 Firmware: before 8.40-cdi394n — fixed in 8.40-cdi394n
Lenovo Thinkagile Hx1520-R Firmware: before 8.40-cdi394n — fixed in 8.40-cdi394n
Lenovo Thinkagile Hx1521-R Firmware: before 8.40-cdi394n — fixed in 8.40-cdi394n
Lenovo Thinkagile Hx2320-E Firmware: before 8.40-cdi394n — fixed in 8.40-cdi394n
Lenovo Thinkagile Hx2321 Firmware: before 8.40-cdi394n — fixed in 8.40-cdi394n
Lenovo Thinkagile Hx2720-E Firmware: before 5.20_tei3c8m — fixed in 5.20_tei3c8m
Lenovo Thinkagile Hx3320 Firmware: before 8.40-cdi394n — fixed in 8.40-cdi394n
Lenovo Thinkagile Hx3321 Firmware: before 8.40-cdi394n — fixed in 8.40-cdi394n
Lenovo Thinkagile Hx3375 Firmware: before 4.10_d8bt38l — fixed in 4.10_d8bt38l
Lenovo Thinkagile Hx3376 Firmware: before 4.10_d8bt38l — fixed in 4.10_d8bt38l
Lenovo Thinkagile Hx3520-G Firmware: before 8.40-cdi394n — fixed in 8.40-cdi394n
Lenovo Thinkagile Hx3521-G Firmware: before 8.40-cdi394n — fixed in 8.40-cdi394n
Lenovo Thinkagile Hx3720 Firmware: before 5.20_tei3c8m — fixed in 5.20_tei3c8m
Lenovo Thinkagile Hx3721 Firmware: before 5.20_tei3c8m — fixed in 5.20_tei3c8m
Lenovo Thinkagile Hx5520-C Firmware: before 8.40-cdi394n — fixed in 8.40-cdi394n
Lenovo Thinkagile Hx5520 Firmware: before 8.40-cdi394n — fixed in 8.40-cdi394n
Lenovo Thinkagile Hx5521-C Firmware: before 8.40-cdi394n — fixed in 8.40-cdi394n
Lenovo Thinkagile Hx5521 Firmware: before 8.40-cdi394n — fixed in 8.40-cdi394n
Lenovo Thinkagile Hx7520 Firmware: before 8.40-cdi394n — fixed in 8.40-cdi394n
Lenovo Thinkagile Hx7521 Firmware: before 8.40-cdi394n — fixed in 8.40-cdi394n
Lenovo Thinkagile Hx7820 Firmware: before 2.50_psi346l — fixed in 2.50_psi346l
Lenovo Thinkagile Hx7821 Firmware: before 2.50_psi346l — fixed in 2.50_psi346l
Lenovo Thinkagile Hx Enclosure Certified Node Firmware: before 5.20_tei3c8m — fixed in 5.20_tei3c8m
Lenovo Thinkagile Mx1020 Firmware: through 3.60_tei386m
Lenovo Thinkagile Mx1021 Firmware: before 3.60_tei386m — fixed in 3.60_tei386m
Lenovo Thinkagile Mx3330-F Firmware: before 1.80_afbt20n — fixed in 1.80_afbt20n
Lenovo Thinkagile Mx3330-H Firmware: before 1.80_afbt20n — fixed in 1.80_afbt20n
Lenovo Thinkagile Mx3331-F Firmware: before 1.80_afbt20n — fixed in 1.80_afbt20n

How to fix

Upgrade to a fixed version: Lenovo Thinkagile Hx1021 Firmware 3.60_tei386m; Lenovo Thinkagile Hx1320 Firmware 8.40-cdi394n; Lenovo Thinkagile Hx1321 Firmware 8.40-cdi394n; Lenovo Thinkagile Hx1520-R Firmware 8.40-cdi394n; Lenovo Thinkagile Hx1521-R Firmware 8.40-cdi394n; Lenovo Thinkagile Hx2320-E Firmware 8.40-cdi394n; Lenovo Thinkagile Hx2321 Firmware 8.40-cdi394n; Lenovo Thinkagile Hx2720-E Firmware 5.20_tei3c8m; Lenovo Thinkagile Hx3320 Firmware 8.40-cdi394n; Lenovo Thinkagile Hx3321 Firmware 8.40-cdi394n; Lenovo Thinkagile Hx3375 Firmware 4.10_d8bt38l; Lenovo Thinkagile Hx3376 Firmware 4.10_d8bt38l. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2022-34888 or the next vulnerability affects your stack