PT-2024-10054 · Lenovo · Lenovo Xclarity Controller

Published 2024-07-09 · Updated 2024-07-29 · CVE-2024-38508

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Lenovo XClarity Controller (XCC) (affected versions not specified)

Description A privilege escalation issue was found in the web interface or SSH captive command shell interface of XCC. This could allow an authenticated XCC user with elevated privileges to perform command injection via a specially crafted request. The issue is related to the failure to neutralize special elements, which could enable a remote attacker to execute arbitrary commands.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BDU:2025-00192

CVE-2024-38508

Affected Products

Lenovo Xclarity Controller

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2024-38508 · Security Note
• https://bdu.fstec.ru/vul/2025-00192 · Security Note
• https://t.me/cvenotify/87616 · Telegram Post
• https://support.lenovo.com/vn/en/product_security/ps500634-lenovo-xclarity-controller-xcc-vulnerabilities · Note
• https://t.me/cvedetector/1721 · Telegram Post
• https://support.lenovo.com/us/en/product_security/LEN-156781 · Note