CVE-2024-8059

Severity: medium (CVSS 4.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-09-13 · updated 2026-06-17
Weakness: CWE-319

Description

IPMI credentials may be captured in XCC audit log entries when the account username length is 16 characters.

Affected products

Lenovo HX1021 Edge Certified Node 3yr (ThinkAgile) XCC: before 4.12 TEI3E4D — fixed in 4.12 TEI3E4D
Lenovo HX1320 Appliance (ThinkAgile) XCC: before 9.98 CDI3B4E — fixed in 9.98 CDI3B4E
Lenovo HX1321 Certified Node (ThinkAgile) XCC: before 9.98 CDI3B4E — fixed in 9.98 CDI3B4E
Lenovo HX1331 Certified Node (ThinkAgile) XCC: before 5.10 AFBT50F — fixed in 5.10 AFBT50F
Lenovo HX1520-R Appliance (ThinkAgile) XCC: before 9.98 CDI3B4E — fixed in 9.98 CDI3B4E
Lenovo HX1521-R Certified Node (ThinkAgile) XCC: before 9.98 CDI3B4E — fixed in 9.98 CDI3B4E
Lenovo HX2320-E Appliance (ThinkAgile) XCC: before 9.98 CDI3B4E — fixed in 9.98 CDI3B4E
Lenovo HX2321 Certified Node (ThinkAgile) XCC: before 9.98 CDI3B4E — fixed in 9.98 CDI3B4E
Lenovo HX2330 Appliance (ThinkAgile) XCC: before 5.10 AFBT50F — fixed in 5.10 AFBT50F
Lenovo HX2331 Certified Node (ThinkAgile) XCC: before 5.10 AFBT50F — fixed in 5.10 AFBT50F
Lenovo HX2720-E Appliance (ThinkAgile) XCC: before 6.40 TEI3F3E — fixed in 6.40 TEI3F3E
Lenovo HX3320 Appliance (ThinkAgile) XCC: before 9.98 CDI3B4E — fixed in 9.98 CDI3B4E
Lenovo HX3321 Certified Node (ThinkAgile) XCC: before 9.98 CDI3B4E — fixed in 9.98 CDI3B4E
Lenovo HX3330 Appliance (ThinkAgile) XCC: before 5.10 AFBT50F — fixed in 5.10 AFBT50F
Lenovo HX3331 Certified Node (ThinkAgile) XCC: before 5.10 AFBT50F — fixed in 5.10 AFBT50F
Lenovo HX3331 Node SAP HANA (ThinkAgile) XCC: before 5.10 AFBT50F — fixed in 5.10 AFBT50F
Lenovo HX3375 Appliance (ThinkAgile) XCC: before 5.80 D8BT66D — fixed in 5.80 D8BT66D
Lenovo HX3376 Certified Node (ThinkAgile) XCC: before 5.80 D8BT66D — fixed in 5.80 D8BT66D
Lenovo HX3520-G Appliance (ThinkAgile) XCC: before 9.98 CDI3B4E — fixed in 9.98 CDI3B4E
Lenovo HX3521-G Certified Node (ThinkAgile) XCC: before 9.98 CDI3B4E — fixed in 9.98 CDI3B4E
Lenovo HX3720 Appliance (ThinkAgile) XCC: before 6.40 TEI3F3E — fixed in 6.40 TEI3F3E
Lenovo HX3721 Certified Node (ThinkAgile) XCC: before 6.40 TEI3F3E — fixed in 6.40 TEI3F3E
Lenovo HX5520-C Appliance (ThinkAgile) XCC: before 9.98 CDI3B4E — fixed in 9.98 CDI3B4E
Lenovo HX5520 Appliance (ThinkAgile) XCC: before 9.98 CDI3B4E — fixed in 9.98 CDI3B4E
Lenovo HX5521-C Certified Node (ThinkAgile) XCC: before 9.98 CDI3B4E — fixed in 9.98 CDI3B4E
Lenovo HX5521 Certified Node (ThinkAgile) XCC: before 9.98 CDI3B4E — fixed in 9.98 CDI3B4E
Lenovo HX5530 Appliance (ThinkAgile) XCC: before 5.10 AFBT50F — fixed in 5.10 AFBT50F
Lenovo HX5531 Certified Node (ThinkAgile) XCC: before 5.10 AFBT50F — fixed in 5.10 AFBT50F
Lenovo HX7520 Appliance (ThinkAgile) XCC: before 9.98 CDI3B4E — fixed in 9.98 CDI3B4E
Lenovo HX7521 Certified Node (ThinkAgile) XCC: before 9.98 CDI3B4E — fixed in 9.98 CDI3B4E

How to fix

Upgrade to a fixed version: Lenovo HX1021 Edge Certified Node 3yr (ThinkAgile) XCC 4.12 TEI3E4D; Lenovo HX1320 Appliance (ThinkAgile) XCC 9.98 CDI3B4E; Lenovo HX1321 Certified Node (ThinkAgile) XCC 9.98 CDI3B4E; Lenovo HX1331 Certified Node (ThinkAgile) XCC 5.10 AFBT50F; Lenovo HX1520-R Appliance (ThinkAgile) XCC 9.98 CDI3B4E; Lenovo HX1521-R Certified Node (ThinkAgile) XCC 9.98 CDI3B4E; Lenovo HX2320-E Appliance (ThinkAgile) XCC 9.98 CDI3B4E; Lenovo HX2321 Certified Node (ThinkAgile) XCC 9.98 CDI3B4E; Lenovo HX2330 Appliance (ThinkAgile) XCC 5.10 AFBT50F; Lenovo HX2331 Certified Node (ThinkAgile) XCC 5.10 AFBT50F; Lenovo HX2720-E Appliance (ThinkAgile) XCC 6.40 TEI3F3E; Lenovo HX3320 Appliance (ThinkAgile) XCC 9.98 CDI3B4E. Check the vendor advisory for mitigations.

References

https://support.lenovo.com/us/en/product_security/LEN-172051

Get alerted when CVE-2024-8059 or the next vulnerability affects your stack