CVE-2024-38509

Severity: high (CVSS 7.2 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-07-26 · updated 2026-06-17
Weakness: CWE-121

Description

A privilege escalation vulnerability was discovered in XCC that could allow an authenticated XCC user with elevated privileges to execute arbitrary code via a specially crafted IPMI command.

Affected products

Lenovo Thinkagile Hx1021 Edg Firmware: before 4.11 — fixed in 4.11
Lenovo Thinkagile Hx1320 Firmware: before 9.97 — fixed in 9.97
Lenovo Thinkagile Hx1321 Firmware: before 9.97 — fixed in 9.97
Lenovo Thinkagile Hx1331 Firmware: before 4.71 — fixed in 4.71
Lenovo Thinkagile Hx1520-R Firmware: before 9.97 — fixed in 9.97
Lenovo Thinkagile Hx1521-R Firmware: before 9.97 — fixed in 9.97
Lenovo Thinkagile Hx2320-E Firmware: before 9.97 — fixed in 9.97
Lenovo Thinkagile Hx2321 Firmware: before 9.97 — fixed in 9.97
Lenovo Thinkagile Hx2330 Firmware: before 4.71 — fixed in 4.71
Lenovo Thinkagile Hx2331 Firmware: before 4.71 — fixed in 4.71
Lenovo Thinkagile Hx2720-E Firmware: before 4.11 — fixed in 4.11
Lenovo Thinkagile Hx3320 Firmware: before 9.97 — fixed in 9.97
Lenovo Thinkagile Hx3321 Firmware: before 9.97 — fixed in 9.97
Lenovo Thinkagile Hx3330 Firmware: before 4.71 — fixed in 4.71
Lenovo Thinkagile Hx3331: before 4.71 — fixed in 4.71
Lenovo Thinkagile Hx3375 Firmware: before 5.61 — fixed in 5.61
Lenovo Thinkagile Hx3376 Firmware: before 5.61 — fixed in 5.61
Lenovo Thinkagile Hx3520-G Firmware: before 9.97 — fixed in 9.97
Lenovo Thinkagile Hx3521-G Firmware: before 9.97 — fixed in 9.97
Lenovo Thinkagile Hx3720 Firmware: before 4.11 — fixed in 4.11
Lenovo Thinkagile Hx3721 Firmware: before 4.11 — fixed in 4.11
Lenovo Thinkagile Hx5520-C Firmware: before 9.97 — fixed in 9.97
Lenovo Thinkagile Hx5521-C Firmware: before 9.97 — fixed in 9.97
Lenovo Thinkagile Hx5530 Firmware: before 4.71 — fixed in 4.71
Lenovo Thinkagile Hx5531 Firmware: before 4.71 — fixed in 4.71
Lenovo Thinkagile Hx7520 Firmware: before 9.97 — fixed in 9.97
Lenovo Thinkagile Hx7521 Firmware: before 9.97 — fixed in 9.97
Lenovo Thinkagile Hx7530 Firmware: before 4.71 — fixed in 4.71
Lenovo Thinkagile Hx7531 Firmware: before 4.71 — fixed in 4.71
Lenovo Thinkagile Hx7820 Firmware: before 3.11 — fixed in 3.11

How to fix

Upgrade to a fixed version: Lenovo Thinkagile Hx1021 Edg Firmware 4.11; Lenovo Thinkagile Hx1320 Firmware 9.97; Lenovo Thinkagile Hx1321 Firmware 9.97; Lenovo Thinkagile Hx1331 Firmware 4.71; Lenovo Thinkagile Hx1520-R Firmware 9.97; Lenovo Thinkagile Hx1521-R Firmware 9.97; Lenovo Thinkagile Hx2320-E Firmware 9.97; Lenovo Thinkagile Hx2321 Firmware 9.97; Lenovo Thinkagile Hx2330 Firmware 4.71; Lenovo Thinkagile Hx2331 Firmware 4.71; Lenovo Thinkagile Hx2720-E Firmware 4.11; Lenovo Thinkagile Hx3320 Firmware 9.97. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2024-38509 or the next vulnerability affects your stack