CVE-2024-8281

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

An input validation weakness was discovered in XCC that could allow a valid, authenticated XCC user with elevated privileges to perform command injection through specially crafted command line input in the XCC SSH captive shell.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

VendorProductVersions
LenovoHX5530 Appliance (ThinkAgile) XCC< 4.71 AFBT48C
LenovoHX7530 Appliance (ThinkAgile) XCC< 4.71 AFBT48C
LenovoST250 V3 (ThinkSystem) XCC< 2.10 CTX312G
LenovoVX3331 Certified Node (ThinkAgile) XCC< 4.71 AFBT48C
LenovoHX Enclosure Certified Node (ThinkAgile) XCC< 6.36 TEI3F4A
LenovoHX1021 Edge Certified Node 3yr (ThinkAgile) XCC< 4.11 TEI3E4A
LenovoHX1320 Appliance (ThinkAgile) XCC< 9.97 CDI3B4B
LenovoHX1321 Certified Node (ThinkAgile) XCC< 9.97 CDI3B4B
LenovoHX1331 Certified Node (ThinkAgile) XCC< 4.71 AFBT48C
LenovoHX1520-R Appliance (ThinkAgile) XCC< 9.97 CDI3B4B
LenovoHX1521-R Certified Node (ThinkAgile) XCC< 9.97 CDI3B4B
LenovoHX2320-E Appliance (ThinkAgile) XCC< 9.97 CDI3B4B
LenovoHX2321 Certified Node (ThinkAgile) XCC< 9.97 CDI3B4B
LenovoHX2330 Appliance (ThinkAgile) XCC< 4.71 AFBT48C
LenovoHX2331 Certified Node (ThinkAgile) XCC< 4.71 AFBT48C
LenovoHX2720-E Appliance (ThinkAgile) XCC< 6.36 TEI3F4A
LenovoHX3320 Appliance (ThinkAgile) XCC< 9.97 CDI3B4B
LenovoHX3321 Certified Node (ThinkAgile) XCC< 9.97 CDI3B4B
LenovoHX3330 Appliance (ThinkAgile) XCC< 4.71 AFBT48C
LenovoHX3331 Certified Node (ThinkAgile) XCC< 4.71 AFBT48C
LenovoHX3331 Node SAP HANA (ThinkAgile) XCC< 4.71 AFBT48C
LenovoHX3375 Appliance (ThinkAgile) XCC< 5.61 D8BT64D
LenovoHX3376 Certified Node (ThinkAgile) XCC< 5.61 D8BT64D
LenovoHX3520-G Appliance (ThinkAgile) XCC< 9.97 CDI3B4B
LenovoHX3521-G Certified Node (ThinkAgile) XCC< 9.97 CDI3B4B
LenovoHX3720 Appliance (ThinkAgile) XCC< 6.36 TEI3F4A
LenovoHX3721 Certified Node (ThinkAgile) XCC< 6.36 TEI3F4A
LenovoHX5520 Appliance (ThinkAgile) XCC< 9.97 CDI3B4B
LenovoHX5520-C Appliance (ThinkAgile) XCC< 9.97 CDI3B4B
LenovoHX5521 Certified Node (ThinkAgile) XCC< 9.97 CDI3B4B
LenovoHX5521-C Certified Node (ThinkAgile) XCC< 9.97 CDI3B4B
LenovoHX5531 Certified Node (ThinkAgile) XCC< 4.71 AFBT48C
LenovoHX7520 Appliance (ThinkAgile) XCC< 9.97 CDI3B4B
LenovoHX7521 Certified Node (ThinkAgile) XCC< 9.97 CDI3B4B
LenovoHX7530 Appl for SAP HANA (ThinkAgile) XCC< 4.71 AFBT48C
LenovoHX7531 Certified Node (ThinkAgile) XCC< 4.71 AFBT48C
LenovoHX7531 Node SAP HANA (ThinkAgile) XCC< 4.71 AFBT48C
LenovoHX7820 Appliance (ThinkAgile) XCC< 3.11 PSI354A
LenovoHX7821 Certified Node (ThinkAgile) XCC< 3.11 PSI354A
LenovoMX Edge Appliance - MX1020 (ThinkAgile) XCC< 4.11 TEI3E4A
LenovoMX3330-F All-flash Appliance (ThinkAgile) XCC< 4.71 AFBT48C
LenovoMX3330-H Hybrid Appliance (ThinkAgile) XCC< 4.71 AFBT48C
LenovoMX3331-F All-flash Certified node (ThinkAgile) XCC< 4.71 AFBT48C
LenovoMX3331-H Hybrid Certified node (ThinkAgile) XCC< 4.71 AFBT48C
LenovoMX3530 F All flash Appliance (ThinkAgile) XCC< 4.71 AFBT48C
LenovoMX3530-H Hybrid Appliance (ThinkAgile) XCC< 4.71 AFBT48C
LenovoMX3531 H Hybrid Certified node (ThinkAgile) XCC< 4.71 AFBT48C
LenovoMX3531-F All-flash Certified node (ThinkAgile) XCC< 4.71 AFBT48C
LenovoP920 Rack Workstation (ThinkStation) XCC< 9.97 CDI3B4B
LenovoSD530 (ThinkSystem) XCC< 6.36 TEI3F4A

References

Timeline

Published
Sep 13, 2024
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2024

CVE-2024-82825.4The Ibtana – WordPress Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘align’ attribute within thCVE-2024-82834.8The Slider by 10Web WordPress plugin before 1.2.59 does not sanitise and escape some of its settings, which could allow high privilege userCVE-2024-82844.8The Download Manager WordPress plugin before 3.2.99 does not sanitise and escape some of its settings, which could allow high privilege userCVE-2024-82855.9A flaw was found in Kroxylicious. When establishing the connection with the upstream Kafka server using a TLS secured connection, KroxylicioCVE-2024-82866.5The webtoffee-gdpr-cookie-consent WordPress plugin before 2.6.1 does not have CSRF checks in some bulk actions, which could allow attackers CVE-2024-82877.5Anbox Management Service, in versions 1.17.0 through 1.23.0, does not validate the TLS certificate provided to it by the Anbox Stream Agent.CVE-2024-82886.4The Guten Post Layout – An Advanced Post Grid Collection for WordPress Gutenberg plugin for WordPress is vulnerable to Stored Cross-Site ScrCVE-2024-82899.8The MultiVendorX – The Ultimate WooCommerce Multivendor Marketplace Solution plugin for WordPress is vulnerable to privilege escalation/de-eCVE-2024-82908.8The WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible plugin for WordPress is vulnerable to InsecCVE-2024-82914.8Concrete CMS versions 9.0.0 to 9.3.3 and below 8.5.19 are vulnerable to Stored XSS in Image Editor Background Color.  A rogue admin could adCVE-2024-82929.8The WP-Recall – Registration, Profile, Commerce & More plugin for WordPress is vulnerable to privilege escalation/account takeover in all veCVE-2024-82949.8A vulnerability, which was classified as critical, was found in FeehiCMS up to 2.1.1. This affects the function update of the file /admin/in
CVE-2024-8281: High severity, CVSS 7.2 | Vulnix