Description
An input validation weakness was discovered in XCC that could allow a valid, authenticated XCC user with elevated privileges to perform command injection through specially crafted command line input in the XCC SSH captive shell.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Lenovo | HX5530 Appliance (ThinkAgile) XCC | < 4.71 AFBT48C | 4.71 AFBT48C |
| Lenovo | HX7530 Appliance (ThinkAgile) XCC | < 4.71 AFBT48C | 4.71 AFBT48C |
| Lenovo | ST250 V3 (ThinkSystem) XCC | < 2.10 CTX312G | 2.10 CTX312G |
| Lenovo | VX3331 Certified Node (ThinkAgile) XCC | < 4.71 AFBT48C | 4.71 AFBT48C |
| Lenovo | HX Enclosure Certified Node (ThinkAgile) XCC | < 6.36 TEI3F4A | 6.36 TEI3F4A |
| Lenovo | HX1021 Edge Certified Node 3yr (ThinkAgile) XCC | < 4.11 TEI3E4A | 4.11 TEI3E4A |
| Lenovo | HX1320 Appliance (ThinkAgile) XCC | < 9.97 CDI3B4B | 9.97 CDI3B4B |
| Lenovo | HX1321 Certified Node (ThinkAgile) XCC | < 9.97 CDI3B4B | 9.97 CDI3B4B |
| Lenovo | HX1331 Certified Node (ThinkAgile) XCC | < 4.71 AFBT48C | 4.71 AFBT48C |
| Lenovo | HX1520-R Appliance (ThinkAgile) XCC | < 9.97 CDI3B4B | 9.97 CDI3B4B |
| Lenovo | HX1521-R Certified Node (ThinkAgile) XCC | < 9.97 CDI3B4B | 9.97 CDI3B4B |
| Lenovo | HX2320-E Appliance (ThinkAgile) XCC | < 9.97 CDI3B4B | 9.97 CDI3B4B |
| Lenovo | HX2321 Certified Node (ThinkAgile) XCC | < 9.97 CDI3B4B | 9.97 CDI3B4B |
| Lenovo | HX2330 Appliance (ThinkAgile) XCC | < 4.71 AFBT48C | 4.71 AFBT48C |
| Lenovo | HX2331 Certified Node (ThinkAgile) XCC | < 4.71 AFBT48C | 4.71 AFBT48C |
| Lenovo | HX2720-E Appliance (ThinkAgile) XCC | < 6.36 TEI3F4A | 6.36 TEI3F4A |
| Lenovo | HX3320 Appliance (ThinkAgile) XCC | < 9.97 CDI3B4B | 9.97 CDI3B4B |
| Lenovo | HX3321 Certified Node (ThinkAgile) XCC | < 9.97 CDI3B4B | 9.97 CDI3B4B |
| Lenovo | HX3330 Appliance (ThinkAgile) XCC | < 4.71 AFBT48C | 4.71 AFBT48C |
| Lenovo | HX3331 Certified Node (ThinkAgile) XCC | < 4.71 AFBT48C | 4.71 AFBT48C |
| Lenovo | HX3331 Node SAP HANA (ThinkAgile) XCC | < 4.71 AFBT48C | 4.71 AFBT48C |
| Lenovo | HX3375 Appliance (ThinkAgile) XCC | < 5.61 D8BT64D | 5.61 D8BT64D |
| Lenovo | HX3376 Certified Node (ThinkAgile) XCC | < 5.61 D8BT64D | 5.61 D8BT64D |
| Lenovo | HX3520-G Appliance (ThinkAgile) XCC | < 9.97 CDI3B4B | 9.97 CDI3B4B |
| Lenovo | HX3521-G Certified Node (ThinkAgile) XCC | < 9.97 CDI3B4B | 9.97 CDI3B4B |
| Lenovo | HX3720 Appliance (ThinkAgile) XCC | < 6.36 TEI3F4A | 6.36 TEI3F4A |
| Lenovo | HX3721 Certified Node (ThinkAgile) XCC | < 6.36 TEI3F4A | 6.36 TEI3F4A |
| Lenovo | HX5520 Appliance (ThinkAgile) XCC | < 9.97 CDI3B4B | 9.97 CDI3B4B |
| Lenovo | HX5520-C Appliance (ThinkAgile) XCC | < 9.97 CDI3B4B | 9.97 CDI3B4B |
| Lenovo | HX5521 Certified Node (ThinkAgile) XCC | < 9.97 CDI3B4B | 9.97 CDI3B4B |
| Lenovo | HX5521-C Certified Node (ThinkAgile) XCC | < 9.97 CDI3B4B | 9.97 CDI3B4B |
| Lenovo | HX5531 Certified Node (ThinkAgile) XCC | < 4.71 AFBT48C | 4.71 AFBT48C |
| Lenovo | HX7520 Appliance (ThinkAgile) XCC | < 9.97 CDI3B4B | 9.97 CDI3B4B |
| Lenovo | HX7521 Certified Node (ThinkAgile) XCC | < 9.97 CDI3B4B | 9.97 CDI3B4B |
| Lenovo | HX7530 Appl for SAP HANA (ThinkAgile) XCC | < 4.71 AFBT48C | 4.71 AFBT48C |
| Lenovo | HX7531 Certified Node (ThinkAgile) XCC | < 4.71 AFBT48C | 4.71 AFBT48C |
| Lenovo | HX7531 Node SAP HANA (ThinkAgile) XCC | < 4.71 AFBT48C | 4.71 AFBT48C |
| Lenovo | HX7820 Appliance (ThinkAgile) XCC | < 3.11 PSI354A | 3.11 PSI354A |
| Lenovo | HX7821 Certified Node (ThinkAgile) XCC | < 3.11 PSI354A | 3.11 PSI354A |
| Lenovo | MX Edge Appliance - MX1020 (ThinkAgile) XCC | < 4.11 TEI3E4A | 4.11 TEI3E4A |
| Lenovo | MX3330-F All-flash Appliance (ThinkAgile) XCC | < 4.71 AFBT48C | 4.71 AFBT48C |
| Lenovo | MX3330-H Hybrid Appliance (ThinkAgile) XCC | < 4.71 AFBT48C | 4.71 AFBT48C |
| Lenovo | MX3331-F All-flash Certified node (ThinkAgile) XCC | < 4.71 AFBT48C | 4.71 AFBT48C |
| Lenovo | MX3331-H Hybrid Certified node (ThinkAgile) XCC | < 4.71 AFBT48C | 4.71 AFBT48C |
| Lenovo | MX3530 F All flash Appliance (ThinkAgile) XCC | < 4.71 AFBT48C | 4.71 AFBT48C |
| Lenovo | MX3530-H Hybrid Appliance (ThinkAgile) XCC | < 4.71 AFBT48C | 4.71 AFBT48C |
| Lenovo | MX3531 H Hybrid Certified node (ThinkAgile) XCC | < 4.71 AFBT48C | 4.71 AFBT48C |
| Lenovo | MX3531-F All-flash Certified node (ThinkAgile) XCC | < 4.71 AFBT48C | 4.71 AFBT48C |
| Lenovo | P920 Rack Workstation (ThinkStation) XCC | < 9.97 CDI3B4B | 9.97 CDI3B4B |
| Lenovo | SD530 (ThinkSystem) XCC | < 6.36 TEI3F4A | 6.36 TEI3F4A |
| Lenovo | SD530 V3 (ThinkSystem) XCC | < 1.20 USX352 | 1.20 USX352 |
| Lenovo | SD550 V3 (ThinkSystem) XCC | < 1.20 USX352 | 1.20 USX352 |
| Lenovo | SD630 V2 (ThinkSystem) XCC | < 4.11 TGBT50C | 4.11 TGBT50C |
| Lenovo | SD650 DWC Dual Node Tray (ThinkSystem) XCC | < 6.36 TEI3F4A | 6.36 TEI3F4A |
| Lenovo | SD650 V2 (ThinkSystem) XCC | < 4.11 TGBT50C | 4.11 TGBT50C |
| Lenovo | SD650 V3 (ThinkSystem) XCC | < 6.10 USX350G | 6.10 USX350G |
| Lenovo | SD650-N V2 (ThinkSystem) XCC | < 4.11 TGBT50C | 4.11 TGBT50C |
| Lenovo | SD665 V3 (ThinkSystem) XCC | < 6.10 QGX340J | 6.10 QGX340J |
| Lenovo | SE350 (ThinkSystem) XCC | < 4.11 TEI3E4A | 4.11 TEI3E4A |
| Lenovo | SE350 V2 (ThinkEdge) XCC | < 3.11 IYX328M | 3.11 IYX328M |
| Lenovo | SE360 V2 (ThinkEdge) XCC | < 3.11 IYX328M | 3.11 IYX328M |
| Lenovo | SE450 (ThinkEdge) XCC | < 3.11 USX332X | 3.11 USX332X |
| Lenovo | SE455 V3 (ThinkEdge) XCC | < 3.10 MBX308L | 3.10 MBX308L |
| Lenovo | SN550 (ThinkSystem) XCC | < 6.36 TEI3F4A | 6.36 TEI3F4A |
| Lenovo | SN550 V2 (ThinkSystem) XCC | < 4.11 TGBT50C | 4.11 TGBT50C |
| Lenovo | SN850 (ThinkSystem) XCC | < 6.36 TEI3F4A | 6.36 TEI3F4A |
| Lenovo | SR150 (ThinkSystem) XCC | < 6.36 TEI3F4A | 6.36 TEI3F4A |
| Lenovo | SR158 (ThinkSystem) XCC | < 6.36 TEI3F4A | 6.36 TEI3F4A |
| Lenovo | SR250 (ThinkSystem) XCC | < 6.36 TEI3F4A | 6.36 TEI3F4A |
| Lenovo | SR250 V2 (ThinkSystem) XCC | < 4.11 TGBT50C | 4.11 TGBT50C |
| Lenovo | SR250 V3 (ThinkSystem) XCC | < 2.10 CTX312G | 2.10 CTX312G |
| Lenovo | SR258 (ThinkSystem) XCC | < 6.36 TEI3F4A | 6.36 TEI3F4A |
| Lenovo | SR258 V2 (ThinkSystem) XCC | < 4.11 TGBT50C | 4.11 TGBT50C |
| Lenovo | SR258 V3 (ThinkSystem) XCC | < 2.10 CTX312G | 2.10 CTX312G |
| Lenovo | SR530 (ThinkSystem) XCC | < 9.97 CDI3B4B | 9.97 CDI3B4B |
| Lenovo | SR550 (ThinkSystem) XCC | < 9.97 CDI3B4B | 9.97 CDI3B4B |
| Lenovo | SR570 (ThinkSystem) XCC | < 9.97 CDI3B4B | 9.97 CDI3B4B |
| Lenovo | SR590 (ThinkSystem) XCC | < 9.97 CDI3B4B | 9.97 CDI3B4B |
| Lenovo | SR630 (ThinkSystem) XCC | < 9.97 CDI3B4B | 9.97 CDI3B4B |
| Lenovo | SR630 V2 (ThinkSystem) XCC | < 4.71 AFBT48C | 4.71 AFBT48C |
| Lenovo | SR630 V3 (ThinkSystem) XCC | < 5.10 ESX330M | 5.10 ESX330M |
| Lenovo | SR635 V3 (ThinkSystem) XCC | < 3.20 KAX334O | 3.20 KAX334O |
| Lenovo | SR645 (ThinkSystem) XCC | < 5.61 D8BT64D | 5.61 D8BT64D |
| Lenovo | SR645 V3 (ThinkSystem) XCC | < 3.20 KAX334O | 3.20 KAX334O |
| Lenovo | SR650 (ThinkSystem) XCC | < 9.97 CDI3B4B | 9.97 CDI3B4B |
| Lenovo | SR650 V2 (ThinkSystem) XCC | < 4.71 AFBT48C | 4.71 AFBT48C |
| Lenovo | SR650 V3 (ThinkSystem) XCC | < 5.10 ESX330M | 5.10 ESX330M |
| Lenovo | SR655 V3 (ThinkSystem) XCC | < 3.20 KAX334O | 3.20 KAX334O |
| Lenovo | SR665 (ThinkSystem) XCC | < 5.61 D8BT64D | 5.61 D8BT64D |
| Lenovo | SR665 V3 (ThinkSystem) XCC | < 3.20 KAX334O | 3.20 KAX334O |
| Lenovo | SR670 (ThinkSystem) XCC | < 4.11 TEI3E4A | 4.11 TEI3E4A |
| Lenovo | SR670 V2 (ThinkSystem) XCC | < 4.11 TGBT50C | 4.11 TGBT50C |
| Lenovo | SR675 V3 (ThinkSystem) XCC | < 6.10 QGX340J | 6.10 QGX340J |
| Lenovo | SR850 (ThinkSystem) XCC | < 6.36 TEI3F4A | 6.36 TEI3F4A |
| Lenovo | SR850 V2 (ThinkSystem) XCC | < 4.11 TGBT50C | 4.11 TGBT50C |
| Lenovo | SR850 V3 (ThinkSystem) XCC | < 4.10 RSX312I | 4.10 RSX312I |
| Lenovo | SR850P (ThinkSystem) XCC | < 4.11 TEI3E4A | 4.11 TEI3E4A |
| Lenovo | SR860 (ThinkSystem) XCC | < 6.36 TEI3F4A | 6.36 TEI3F4A |
| Lenovo | SR860 V2 (ThinkSystem) XCC | < 4.11 TGBT50C | 4.11 TGBT50C |
| Lenovo | SR860 V3 (ThinkSystem) XCC | < 4.10 RSX312I | 4.10 RSX312I |
Advisories 1
- WID-SEC-2024-2116 Lenovo XClarity: Mehrere Schwachstellen BSI CERT-Bund (WID) · Sep 10, 2024