Thinkagile Mx3530-h Hybrid Firmware (Lenovo) - vulnerabilities (CVEs)
9 CVEs, 0 in the last 30 days, 2 known versions, newest CVE from 2024-09-13. Vendor: Lenovo.
CVEs of Thinkagile Mx3530-h Hybrid Firmware
- CVE-2024-8281 - CVSS 7.2 (high), 2024-09-13: An input validation weakness was discovered in XCC that could allow a valid, authenticated XCC user with elevated privileges to perform command injection…
- CVE-2024-8280 - CVSS 7.2 (high), 2024-09-13: An input validation weakness was discovered in XCC that could allow a valid, authenticated XCC user with elevated privileges to perform command injection or…
- CVE-2024-8279 - CVSS 7.2 (high), 2024-09-13: A privilege escalation vulnerability was discovered in XCC that could allow a valid, authenticated XCC user with elevated privileges to perform command…
- CVE-2024-8278 - CVSS 7.2 (high), 2024-09-13: A privilege escalation vulnerability was discovered in XCC that could allow a valid, authenticated XCC user with elevated privileges to perform command…
- CVE-2024-45105 - CVSS 6.7 (medium), 2024-09-13: An internal product security audit discovered a UEFI SMM (System Management Mode) callout vulnerability in some ThinkSystem servers that could allow a local…
- CVE-2023-4607 - CVSS 8.8 (high), 2023-10-25: An authenticated XCC user can change permissions for any user through a crafted API command.
- CVE-2023-4606 - CVSS 8.1 (high), 2023-10-25: An authenticated XCC user with Read-Only permission can change a different user’s password through a crafted API command. This affects ThinkSystem v2 and v3…
- CVE-2023-4608 - CVSS 7.2 (high), 2023-10-25: An authenticated XCC user with elevated privileges can perform blind SQL injection in limited cases through a crafted API command. This affects ThinkSystem…
- CVE-2022-40137 - CVSS 6.7 (medium), 2023-01-30: A buffer overflow in the WMI SMI Handler in some Lenovo models may allow an attacker with local access and elevated privileges to execute arbitrary code.
