CVE-2024-8280

Severity: high (CVSS 7.2 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-09-13 · updated 2026-06-17
Weakness: CWE-78

Description

An input validation weakness was discovered in XCC that could allow a valid, authenticated XCC user with elevated privileges to perform command injection or cause a recoverable denial of service using a specially crafted file.

Affected products

Lenovo Thinkagile Mx1021 On Se350 Firmware: before 4.11_tei3e4a — fixed in 4.11_tei3e4a
Lenovo Thinkagile Vx3720 Firmware: before 6.36_tei3f4a — fixed in 6.36_tei3f4a
Lenovo Thinkagile Vx635 V3 Firmware: before 3.20_kax334o — fixed in 3.20_kax334o
Lenovo Thinkagile Vx7520 Firmware: before 9.97_cdi3b4b — fixed in 9.97_cdi3b4b
Lenovo Thinkagile Vx7531 Firmware: before 4.71_afbt48c — fixed in 4.71_afbt48c
Lenovo Thinkagile Vx7820 Firmware: before 3.11_psi354a — fixed in 3.11_psi354a
Lenovo Thinkedge Se360 V2 Firmware: before 3.11_iyx328m — fixed in 3.11_iyx328m
Lenovo Thinkedge Se450 Firmware: before 3.11_usx332x — fixed in 3.11_usx332x
Lenovo Thinkedge Se455 V3 Firmware: before 3.10_mbx308l — fixed in 3.10_mbx308l
Lenovo Thinksystem Sd550 V3 Firmware: before 1.20_usx352 — fixed in 1.20_usx352
Lenovo Thinksystem Sd650 V3 Firmware: before 6.10_usx350g — fixed in 6.10_usx350g
Lenovo Thinksystem Sr650 V3 Firmware: before 5.10_esx330m — fixed in 5.10_esx330m
Lenovo Thinksystem Sr665 Firmware: before 5.61_d8bt64d — fixed in 5.61_d8bt64d
Lenovo Thinksystem Sr665 V3 Firmware: before 6.10_qgx340j — fixed in 6.10_qgx340j
Lenovo Thinksystem Sr860 V3 Firmware: before 4.10_rsx312i — fixed in 4.10_rsx312i
Lenovo Thinksystem Sr950 V3 Firmware: before 3.10_ebx308i — fixed in 3.10_ebx308i
Lenovo Thinksystem St258 V3 Firmware: before 2.10_ctx213g — fixed in 2.10_ctx213g
Lenovo Thinksystem St658 V2 Firmware: before 4.11_tgbt50c — fixed in 4.11_tgbt50c

How to fix

Upgrade to a fixed version: Lenovo Thinkagile Mx1021 On Se350 Firmware 4.11_tei3e4a; Lenovo Thinkagile Vx3720 Firmware 6.36_tei3f4a; Lenovo Thinkagile Vx635 V3 Firmware 3.20_kax334o; Lenovo Thinkagile Vx7520 Firmware 9.97_cdi3b4b; Lenovo Thinkagile Vx7531 Firmware 4.71_afbt48c; Lenovo Thinkagile Vx7820 Firmware 3.11_psi354a; Lenovo Thinkedge Se360 V2 Firmware 3.11_iyx328m; Lenovo Thinkedge Se450 Firmware 3.11_usx332x; Lenovo Thinkedge Se455 V3 Firmware 3.10_mbx308l; Lenovo Thinksystem Sd550 V3 Firmware 1.20_usx352; Lenovo Thinksystem Sd650 V3 Firmware 6.10_usx350g; Lenovo Thinksystem Sr650 V3 Firmware 5.10_esx330m. Check the vendor advisory for mitigations.

References

https://support.lenovo.com/us/en/product_security/LEN-172051

Get alerted when CVE-2024-8280 or the next vulnerability affects your stack