{"id":"CVE-2024-38509","aliases":["EUVD-2024-37381","GHSA-jpv7-733x-p7qw"],"status":"published","title":"A privilege escalation vulnerability was discovered in XCC that could allow an authenticated XCC...","description":"A privilege escalation vulnerability was discovered in XCC that could allow an authenticated XCC user with elevated privileges to execute arbitrary code via a specially crafted IPMI command.","severity":{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.0055,"percentile":0.4636,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-121"],"published":"2024-07-26T19:45:01Z","modified":"2026-06-17T07:40:25Z","products":[{"vendor":"lenovo","product":"thinkagile_hx1021_edg_firmware"},{"vendor":"lenovo","product":"thinkagile_hx1320_firmware"},{"vendor":"lenovo","product":"thinkagile_hx1321_firmware"},{"vendor":"lenovo","product":"thinkagile_hx1331_firmware"},{"vendor":"lenovo","product":"thinkagile_hx1520-r_firmware"},{"vendor":"lenovo","product":"thinkagile_hx1521-r_firmware"},{"vendor":"lenovo","product":"thinkagile_hx2320-e_firmware"},{"vendor":"lenovo","product":"thinkagile_hx2321_firmware"},{"vendor":"lenovo","product":"thinkagile_hx2330_firmware"},{"vendor":"lenovo","product":"thinkagile_hx2331_firmware"},{"vendor":"lenovo","product":"thinkagile_hx2720-e_firmware"},{"vendor":"lenovo","product":"thinkagile_hx3320_firmware"},{"vendor":"lenovo","product":"thinkagile_hx3321_firmware"},{"vendor":"lenovo","product":"thinkagile_hx3330_firmware"},{"vendor":"lenovo","product":"thinkagile_hx3331"},{"vendor":"lenovo","product":"thinkagile_hx3375_firmware"},{"vendor":"lenovo","product":"thinkagile_hx3376_firmware"},{"vendor":"lenovo","product":"thinkagile_hx3520-g_firmware"},{"vendor":"lenovo","product":"thinkagile_hx3521-g_firmware"},{"vendor":"lenovo","product":"thinkagile_hx3720_firmware"},{"vendor":"lenovo","product":"thinkagile_hx3721_firmware"},{"vendor":"lenovo","product":"thinkagile_hx5520-c_firmware"},{"vendor":"lenovo","product":"thinkagile_hx5521-c_firmware"},{"vendor":"lenovo","product":"thinkagile_hx5530_firmware"},{"vendor":"lenovo","product":"thinkagile_hx5531_firmware"},{"vendor":"lenovo","product":"thinkagile_hx7520_firmware"},{"vendor":"lenovo","product":"thinkagile_hx7521_firmware"},{"vendor":"lenovo","product":"thinkagile_hx7530_firmware"},{"vendor":"lenovo","product":"thinkagile_hx7531_firmware"},{"vendor":"lenovo","product":"thinkagile_hx7820_firmware"},{"vendor":"lenovo","product":"thinkagile_hx7821_firmware"},{"vendor":"lenovo","product":"thinkagile_hx_enclosure_certified_node_firmware"},{"vendor":"lenovo","product":"thinkagile_mx1020_firmware"},{"vendor":"lenovo","product":"thinkagile_mx3330-f_firmware"},{"vendor":"lenovo","product":"thinkagile_mx3330-h_firmware"},{"vendor":"lenovo","product":"thinkagile_mx3331-f_firmware"},{"vendor":"lenovo","product":"thinkagile_mx3331-h_firmware"},{"vendor":"lenovo","product":"thinkagile_mx3530-h_firmware"},{"vendor":"lenovo","product":"thinkagile_mx3530_f_firmware"},{"vendor":"lenovo","product":"thinkagile_mx3531-f_firmware"},{"vendor":"lenovo","product":"thinkagile_vx1320_firmware"},{"vendor":"lenovo","product":"thinkagile_vx2320_firmware"},{"vendor":"lenovo","product":"thinkagile_vx2330_firmware"},{"vendor":"lenovo","product":"thinkagile_vx3320_firmware"},{"vendor":"lenovo","product":"thinkagile_vx3330_firmware"},{"vendor":"lenovo","product":"thinkagile_vx3331_firmware"},{"vendor":"lenovo","product":"thinkagile_vx3520-g_firmware"},{"vendor":"lenovo","product":"thinkagile_vx3530-g_firmware"},{"vendor":"lenovo","product":"thinkagile_vx3720_firmware"},{"vendor":"lenovo","product":"thinkagile_vx5520_firmware"},{"vendor":"lenovo","product":"thinkagile_vx5530_firmware"},{"vendor":"lenovo","product":"thinkagile_vx7320_n_firmware"},{"vendor":"lenovo","product":"thinkagile_vx7330_firmware"},{"vendor":"lenovo","product":"thinkagile_vx7520_firmware"},{"vendor":"lenovo","product":"thinkagile_vx7520_n_firmware"},{"vendor":"lenovo","product":"thinkagile_vx7530_firmware"},{"vendor":"lenovo","product":"thinkagile_vx7531_firmware"},{"vendor":"lenovo","product":"thinkagile_vx7820_firmware"},{"vendor":"lenovo","product":"thinkstation_p920_workstation_firmware"},{"vendor":"lenovo","product":"thinksystem_sd530_firmware"},{"vendor":"lenovo","product":"thinksystem_sd630_v2_firmware"},{"vendor":"lenovo","product":"thinksystem_sd650-n_v2_firmware"},{"vendor":"lenovo","product":"thinksystem_sd650_dual_node_tray_firmware"},{"vendor":"lenovo","product":"thinksystem_sd650_v3_firmware"},{"vendor":"lenovo","product":"thinksystem_sd665_v3_firmware"},{"vendor":"lenovo","product":"thinksystem_se350_firmware"},{"vendor":"lenovo","product":"thinksystem_sn550_firmware"},{"vendor":"lenovo","product":"thinksystem_sn550_v2_firmware"},{"vendor":"lenovo","product":"thinksystem_sn850_firmware"},{"vendor":"lenovo","product":"thinksystem_sr150_firmware"},{"vendor":"lenovo","product":"thinksystem_sr158_firmware"},{"vendor":"lenovo","product":"thinksystem_sr250_firmware"},{"vendor":"lenovo","product":"thinksystem_sr250_v2_firmware"},{"vendor":"lenovo","product":"thinksystem_sr258_firmware"},{"vendor":"lenovo","product":"thinksystem_sr258_v2_firmware"},{"vendor":"lenovo","product":"thinksystem_sr530_firmware"},{"vendor":"lenovo","product":"thinksystem_sr550_firmware"},{"vendor":"lenovo","product":"thinksystem_sr570_firmware"},{"vendor":"lenovo","product":"thinksystem_sr590_firmware"},{"vendor":"lenovo","product":"thinksystem_sr630_firmware"},{"vendor":"lenovo","product":"thinksystem_sr630_v2_firmware"},{"vendor":"lenovo","product":"thinksystem_sr630_v3_firmware"},{"vendor":"lenovo","product":"thinksystem_sr635_firmware"},{"vendor":"lenovo","product":"thinksystem_sr645_firmware"},{"vendor":"lenovo","product":"thinksystem_sr645_v3_firmware"},{"vendor":"lenovo","product":"thinksystem_sr650_firmware"},{"vendor":"lenovo","product":"thinksystem_sr650_v2_firmware"},{"vendor":"lenovo","product":"thinksystem_sr655_v3_firmware"},{"vendor":"lenovo","product":"thinksystem_sr665_firmware"},{"vendor":"lenovo","product":"thinksystem_sr665_v3_firmware"},{"vendor":"lenovo","product":"thinksystem_sr670_firmware"},{"vendor":"lenovo","product":"thinksystem_sr670_v2_firmware"},{"vendor":"lenovo","product":"thinksystem_sr675_v3_firmware"},{"vendor":"lenovo","product":"thinksystem_sr850_firmware"},{"vendor":"lenovo","product":"thinksystem_sr850_v2_firmware"},{"vendor":"lenovo","product":"thinksystem_sr850_v3_firmware"},{"vendor":"lenovo","product":"thinksystem_sr850p_firmware"},{"vendor":"lenovo","product":"thinksystem_sr860_firmware"},{"vendor":"lenovo","product":"thinksystem_sr860_v2_firmware"},{"vendor":"lenovo","product":"thinksystem_sr860_v3_firmware"},{"vendor":"lenovo","product":"thinksystem_sr950_firmware"},{"vendor":"lenovo","product":"thinksystem_st250_firmware"},{"vendor":"lenovo","product":"thinksystem_st250_v2_firmware"},{"vendor":"lenovo","product":"thinksystem_st258_firmware"},{"vendor":"lenovo","product":"thinksystem_st258_v2_firmware"},{"vendor":"lenovo","product":"thinksystem_st550_firmware"},{"vendor":"lenovo","product":"thinksystem_st650_v2_firmware"},{"vendor":"lenovo","product":"thinksystem_st650_v3_firmware"},{"vendor":"lenovo","product":"thinksystem_st658_v2_firmware"},{"vendor":"lenovo","product":"thinksystem_st658_v3_firmware"},{"vendor":"lenovo","product":"xclarity controller"}],"references":[{"url":"https://support.lenovo.com/us/en/product_security/LEN-156781","tags":["x_transferred"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-38509"},{"url":"https://github.com/advisories/GHSA-jpv7-733x-p7qw"}],"sources":{"cve":[{"id":"CVE-2024-38509","description":"A privilege escalation vulnerability was discovered in XCC that could allow an authenticated XCC user with elevated privileges to execute arbitrary code via a specially crafted IPMI command.","status":"published","published":"2024-07-26T19:45:01.471Z","modified":"2024-08-02T04:12:24.979Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-121"],"updated_at":"2026-11-02T14:34:16.367792Z"}],"euvd":[{"id":"EUVD-2024-37381","description":"A privilege escalation vulnerability was discovered in XCC that could allow an authenticated XCC user with elevated privileges to execute arbitrary code via a specially crafted IPMI command.","status":"published","published":"2024-07-26T19:45:01Z","modified":"2024-08-02T04:12:24Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T03:50:18.462935Z"}],"ghsa":[{"id":"GHSA-jpv7-733x-p7qw","title":"A privilege escalation vulnerability was discovered in XCC that could allow an authenticated XCC...","description":"A privilege escalation vulnerability was discovered in XCC that could allow an authenticated XCC user with elevated privileges to execute arbitrary code via a specially crafted IPMI command.","status":"published","published":"2024-07-26T21:31:15Z","modified":"2024-07-26T21:31:22Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-121"],"updated_at":"2026-11-02T14:57:44.645006Z"}],"nvd":[{"id":"CVE-2024-38509","description":"A privilege escalation vulnerability was discovered in XCC that could allow an authenticated XCC user with elevated privileges to execute arbitrary code via a specially crafted IPMI command.","status":"published","published":"2024-07-26T20:15:03.83Z","modified":"2026-06-17T07:40:25.46Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-121"],"updated_at":"2026-11-02T14:10:14.437386Z"}]}}