CVE-2024-38512

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

A privilege escalation vulnerability was discovered in XCC that could allow an authenticated XCC user with elevated privileges to perform command injection via specially crafted IPMI commands.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

VendorProductVersions
LenovoXClarity Controllervarious
lenovothinkagile_hx5530_firmware< 4.71
lenovothinkagile_hx7530_firmware< 4.71
lenovothinkagile_vx3331_firmware< 4.71
lenovothinkagile_hx_enclosure_certified_node_firmware< 4.11
lenovothinkagile_hx1021_edg_firmware< 4.11
lenovothinkagile_hx1320_firmware< 9.97
lenovothinkagile_hx1331_firmware< 4.71
lenovothinkagile_hx1321_firmware< 9.97
lenovothinkagile_hx1520-r_firmware< 9.97
lenovothinkagile_hx1521-r_firmware< 9.97
lenovothinkagile_hx2320-e_firmware< 9.97
lenovothinkagile_hx2321_firmware< 9.97
lenovothinkagile_hx2330_firmware< 4.71
lenovothinkagile_hx2331_firmware< 4.71
lenovothinkagile_hx2720-e_firmware< 4.11
lenovothinkagile_hx3320_firmware< 9.97
lenovothinkagile_hx3321_firmware< 9.97
lenovothinkagile_hx3330_firmware< 4.71
lenovothinkagile_hx3331< 4.71
lenovothinkagile_hx3375_firmware< 5.61
lenovothinkagile_hx3376_firmware< 5.61
lenovothinkagile_hx3520-g_firmware< 9.97
lenovothinkagile_hx3521-g_firmware< 9.97
lenovothinkagile_hx3720_firmware< 4.11
lenovothinkagile_hx3721_firmware< 4.11
lenovothinkagile_hx5520-c_firmware< 9.97
lenovothinkagile_hx5521-c_firmware< 9.97
lenovothinkagile_hx5531_firmware< 4.71
lenovothinkagile_hx7520_firmware< 9.97
lenovothinkagile_hx7521_firmware< 9.97
lenovothinkagile_hx7521_firmware< 9.97
lenovothinkagile_hx7530_firmware< 4.71
lenovothinkagile_hx7531_firmware< 4.71
lenovothinkagile_hx7820_firmware< 3.11
lenovothinkagile_hx7821_firmware< 3.11
lenovothinkagile_mx1020_firmware< 4.11
lenovothinkagile_mx3330-f_firmware< 4.71
lenovothinkagile_mx3330-h_firmware< 4.71
lenovothinkagile_mx3331-f_firmware< 4.71
lenovothinkagile_mx3331-h_firmware< 4.71
lenovothinkagile_mx3530_f_firmware< 4.71
lenovothinkagile_mx3530-h_firmware< 4.71
lenovothinkagile_mx3531-f_firmware< 4.71
lenovothinkagile_vx1320_firmware< 4.11
lenovothinkagile_vx2320_firmware< 9.97
lenovothinkagile_vx2330_firmware< 4.71
lenovothinkagile_vx3320_firmware< 9.97
lenovothinkagile_vx3330_firmware< 4.71
lenovothinkagile_vx3520-g_firmware< 9.97

References

Timeline

Published
Jul 26, 2024
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2024

CVE-2024-385139.8Fiber is an Express-inspired web framework written in Go A vulnerability present in versions prior to 2.52.5 is a session middleware issue iCVE-2024-385147.4NextChat is a cross-platform ChatGPT/Gemini UI. There is a Server-Side Request Forgery (SSRF) vulnerability due to a lack of validation of tCVE-2024-385168.8ai-client-html is an Aimeos e-commerce HTML client component. Debug information revealed sensitive information from environment variables inCVE-2024-385177.8Tencent RapidJSON is vulnerable to privilege escalation due to an integer underflow in the `GenericReader::ParseNumber()` function of `incluCVE-2024-385184.6BigBlueButton is an open-source virtual classroom designed to help teachers teach and learners learn. An attacker with a valid join link to CVE-2024-385197.8`yt-dlp` and `youtube-dl` are command-line audio/video downloaders. Prior to the fixed versions, `yt-dlp` and `youtube-dl` do not limit the CVE-2024-38527.5GetBoundName could return the wrong version of an object when JIT optimizations were applied. This vulnerability affects Firefox < 125, FireCVE-2024-385205.3SoftEtherVPN is a an open-source cross-platform multi-protocol VPN Program. When SoftEtherVPN is deployed with L2TP enabled on a device, it CVE-2024-385216.1Hush Line is a free and open-source, anonymous-tip-line-as-a-service for organizations or individuals. There is a stored XSS in the Inbox. TCVE-2024-385226.3Hush Line is a free and open-source, anonymous-tip-line-as-a-service for organizations or individuals. The CSP policy applied on the `tips.hCVE-2024-385237.5Hush Line is a free and open-source, anonymous-tip-line-as-a-service for organizations or individuals. The TOTP authentication flow has multCVE-2024-385247.5GeoServer is an open source server that allows users to share and edit geospatial data. org.geowebcache.GeoWebCacheDispatcher.handleFrontPag
CVE-2024-38512: High severity, CVSS 7.2 | Vulnix