What’s Vulnerable › Vulnerabilities

CVE-2023-4606

• Severity: high (CVSS 8.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-10-25 · updated 2026-06-17
• Weakness: CWE-862

Description

An authenticated XCC user with Read-Only permission can change a different user’s password through a crafted API command.   This affects ThinkSystem v2 and v3 servers with XCC; ThinkSystem v1 servers are not affected.

Affected products

• Lenovo Thinkagile Hx1331 Firmware: all versions
• Lenovo Thinkagile Hx2330 Firmware: all versions
• Lenovo Thinkagile Hx2331 Firmware: all versions
• Lenovo Thinkagile Hx3330 Firmware: all versions
• Lenovo Thinkagile Hx3331 Firmware: all versions
• Lenovo Thinkagile Hx3375 Firmware: all versions
• Lenovo Thinkagile Hx3376 Firmware: all versions
• Lenovo Thinkagile Hx5530 Firmware: all versions
• Lenovo Thinkagile Hx5531 Firmware: all versions
• Lenovo Thinkagile Hx7530 Firmware: all versions
• Lenovo Thinkagile Hx7531 Firmware: all versions
• Lenovo Thinkagile Mx3330-F All-Flash Firmware: all versions
• Lenovo Thinkagile Mx3330-H Hybrid Firmware: all versions
• Lenovo Thinkagile Mx3331-F All-Flash Firmware: all versions
• Lenovo Thinkagile Mx3331-H Hybrid Firmware: all versions
• Lenovo Thinkagile Mx3530-H Hybrid Firmware: all versions
• Lenovo Thinkagile Mx3530 F All Flash Firmware: all versions
• Lenovo Thinkagile Mx3531-F All-Flash Firmware: all versions
• Lenovo Thinkagile Mx3531 H Hybrid Firmware: all versions
• Lenovo Thinkagile Vx2330 Firmware: all versions
• Lenovo Thinkagile Vx3330 Firmware: all versions
• Lenovo Thinkagile Vx3331 Firmware: all versions
• Lenovo Thinkagile Vx3530-G Firmware: all versions
• Lenovo Thinkagile Vx5530 Firmware: all versions
• Lenovo Thinkagile Vx7330 Firmware: all versions
• Lenovo Thinkagile Vx7530 Firmware: all versions
• Lenovo Thinkagile Vx7531 Firmware: all versions
• Lenovo Thinksystem Sd630 V2 Firmware: all versions
• Lenovo Thinksystem Sd650-N V2 Firmware: all versions
• Lenovo Thinksystem Sd650 V2 Firmware: all versions

References

• https://support.lenovo.com/us/en/product_security/LEN-140960
• https://support.lenovo.com/us/en/product_security/LEN-140960

Get alerted when CVE-2023-4606 or the next vulnerability affects your stack