CVE-2023-29056

Severity: medium (CVSS 5.9 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-04-28 · updated 2026-06-17
Weakness: CWE-269

Description

A valid LDAP user, under specific conditions, will default to read-only permissions when authenticating into XCC. To be vulnerable, XCC must be configured to use an LDAP server for Authentication/Authorization and have the login permission attribute not defined.

Affected products

Lenovo Thinkagile Hx1021 Firmware: before 3.72_tei388s — fixed in 3.72_tei388s
Lenovo Thinkagile Hx1320 Firmware: before 8.88_cdi3a4a — fixed in 8.88_cdi3a4a
Lenovo Thinkagile Hx1321 Firmware: before 8.88_cdi3a4a — fixed in 8.88_cdi3a4a
Lenovo Thinkagile Hx1331 Firmware: before 2.93_afbt30p — fixed in 2.93_afbt30p
Lenovo Thinkagile Hx1520-R Firmware: before 8.88_cdi3a4a — fixed in 8.88_cdi3a4a
Lenovo Thinkagile Hx1521-R Firmware: before 8.88_cdi3a4a — fixed in 8.88_cdi3a4a
Lenovo Thinkagile Hx2320-E Firmware: before 8.88_cdi3a4a — fixed in 8.88_cdi3a4a
Lenovo Thinkagile Hx2321 Firmware: before 8.88_cdi3a4a — fixed in 8.88_cdi3a4a
Lenovo Thinkagile Hx2330 Firmware: before 2.93_afbt30p; 2.93_afbt30p — fixed in 2.93_afbt30p
Lenovo Thinkagile Hx2331 Firmware: before 2.93_afbt30p — fixed in 2.93_afbt30p
Lenovo Thinkagile Hx2720-E Firmware: before 3.72_tei388s — fixed in 3.72_tei388s
Lenovo Thinkagile Hx3320 Firmware: before 8.88_cdi3a4a — fixed in 8.88_cdi3a4a
Lenovo Thinkagile Hx3321 Firmware: before 8.88_cdi3a4a — fixed in 8.88_cdi3a4a
Lenovo Thinkagile Hx3330 Firmware: before 2.93_afbt30p — fixed in 2.93_afbt30p
Lenovo Thinkagile Hx3331 Firmware: before 2.93_afbt30p; before 4.71_d8bt48p — fixed in 2.93_afbt30p, 4.71_d8bt48p
Lenovo Thinkagile Hx3375 Firmware: before 4.71_d8bt48p — fixed in 4.71_d8bt48p
Lenovo Thinkagile Hx3376 Firmware: before 8.88_cdi3a4a — fixed in 8.88_cdi3a4a
Lenovo Thinkagile Hx3520-G Firmware: before 8.88_cdi3a4a — fixed in 8.88_cdi3a4a
Lenovo Thinkagile Hx3521-G Firmware: before 3.72_tei388s — fixed in 3.72_tei388s
Lenovo Thinkagile Hx3720 Firmware: before 3.72_tei388s — fixed in 3.72_tei388s
Lenovo Thinkagile Hx3721 Firmware: before 8.88_cdi3a4a — fixed in 8.88_cdi3a4a
Lenovo Thinkagile Hx5520-C Firmware: before 8.88_cdi3a4a — fixed in 8.88_cdi3a4a
Lenovo Thinkagile Hx5520 Firmware: before 8.88_cdi3a4a — fixed in 8.88_cdi3a4a
Lenovo Thinkagile Hx5521-C Firmware: before 2.93_afbt30p — fixed in 2.93_afbt30p
Lenovo Thinkagile Hx5521 Firmware: before 8.88_cdi3a4a — fixed in 8.88_cdi3a4a
Lenovo Thinkagile Hx5530 Firmware: before 2.93_afbt30p — fixed in 2.93_afbt30p
Lenovo Thinkagile Hx5531 Firmware: before 8.88_cdi3a4a — fixed in 8.88_cdi3a4a
Lenovo Thinkagile Hx7520 Firmware: before 8.88_cdi3a4a — fixed in 8.88_cdi3a4a
Lenovo Thinkagile Hx7521 Firmware: before 2.93_afbt30p — fixed in 2.93_afbt30p
Lenovo Thinkagile Hx7530 Firmware: before 2.93_afbt30p — fixed in 2.93_afbt30p

How to fix

Upgrade to a fixed version: Lenovo Thinkagile Hx1021 Firmware 3.72_tei388s; Lenovo Thinkagile Hx1320 Firmware 8.88_cdi3a4a; Lenovo Thinkagile Hx1321 Firmware 8.88_cdi3a4a; Lenovo Thinkagile Hx1331 Firmware 2.93_afbt30p; Lenovo Thinkagile Hx1520-R Firmware 8.88_cdi3a4a; Lenovo Thinkagile Hx1521-R Firmware 8.88_cdi3a4a; Lenovo Thinkagile Hx2320-E Firmware 8.88_cdi3a4a; Lenovo Thinkagile Hx2321 Firmware 8.88_cdi3a4a; Lenovo Thinkagile Hx2330 Firmware 2.93_afbt30p; Lenovo Thinkagile Hx2331 Firmware 2.93_afbt30p; Lenovo Thinkagile Hx2720-E Firmware 3.72_tei388s; Lenovo Thinkagile Hx3320 Firmware 8.88_cdi3a4a. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2023-29056 or the next vulnerability affects your stack