PT-2024-10056 · Lenovo · Lenovo Xclarity Controller

Published 2024-07-09 · Updated 2024-07-29 · CVE-2024-38511

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Lenovo XClarity Controller (XCC) for Lenovo ThinkSystem servers (affected versions not specified)

Description The issue is related to a lack of neutralization of special elements, which could allow a remote attacker to execute arbitrary commands using specially crafted files. It is a privilege escalation vulnerability discovered in the upload processing functionality of XCC, allowing an authenticated XCC user with elevated privileges to perform command injection via specially crafted file uploads.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BDU:2025-00194

CVE-2024-38511

Affected Products

Lenovo Xclarity Controller

References · 6

• https://bdu.fstec.ru/vul/2025-00194 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-38511 · Security Note
• https://t.me/cvedetector/1719 · Telegram Post
• https://support.lenovo.com/us/en/product_security/LEN-156781 · Note
• https://t.me/cvenotify/87619 · Telegram Post
• https://support.lenovo.com/vn/en/product_security/ps500634-lenovo-xclarity-controller-xcc-vulnerabilities · Note