{"id":"CVE-2024-38512","aliases":["EUVD-2024-37384","GHSA-x3wg-9gxm-mq7c"],"status":"published","title":"A privilege escalation vulnerability was discovered in XCC that could allow an authenticated XCC...","description":"A privilege escalation vulnerability was discovered in XCC that could allow an authenticated XCC user with elevated privileges to perform command injection via specially crafted IPMI commands.","severity":{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.01006,"percentile":0.63295,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-78"],"published":"2024-07-26T19:45:31Z","modified":"2026-06-17T07:40:26Z","products":[{"vendor":"lenovo","product":"thinkagile_hx1021_edg_firmware"},{"vendor":"lenovo","product":"thinkagile_hx1320_firmware"},{"vendor":"lenovo","product":"thinkagile_hx1321_firmware"},{"vendor":"lenovo","product":"thinkagile_hx1331_firmware"},{"vendor":"lenovo","product":"thinkagile_hx1520-r_firmware"},{"vendor":"lenovo","product":"thinkagile_hx1521-r_firmware"},{"vendor":"lenovo","product":"thinkagile_hx2320-e_firmware"},{"vendor":"lenovo","product":"thinkagile_hx2321_firmware"},{"vendor":"lenovo","product":"thinkagile_hx2330_firmware"},{"vendor":"lenovo","product":"thinkagile_hx2331_firmware"},{"vendor":"lenovo","product":"thinkagile_hx2720-e_firmware"},{"vendor":"lenovo","product":"thinkagile_hx3320_firmware"},{"vendor":"lenovo","product":"thinkagile_hx3321_firmware"},{"vendor":"lenovo","product":"thinkagile_hx3330_firmware"},{"vendor":"lenovo","product":"thinkagile_hx3331"},{"vendor":"lenovo","product":"thinkagile_hx3375_firmware"},{"vendor":"lenovo","product":"thinkagile_hx3376_firmware"},{"vendor":"lenovo","product":"thinkagile_hx3520-g_firmware"},{"vendor":"lenovo","product":"thinkagile_hx3521-g_firmware"},{"vendor":"lenovo","product":"thinkagile_hx3720_firmware"},{"vendor":"lenovo","product":"thinkagile_hx3721_firmware"},{"vendor":"lenovo","product":"thinkagile_hx5520-c_firmware"},{"vendor":"lenovo","product":"thinkagile_hx5521-c_firmware"},{"vendor":"lenovo","product":"thinkagile_hx5530_firmware"},{"vendor":"lenovo","product":"thinkagile_hx5531_firmware"},{"vendor":"lenovo","product":"thinkagile_hx7520_firmware"},{"vendor":"lenovo","product":"thinkagile_hx7521_firmware"},{"vendor":"lenovo","product":"thinkagile_hx7530_firmware"},{"vendor":"lenovo","product":"thinkagile_hx7531_firmware"},{"vendor":"lenovo","product":"thinkagile_hx7820_firmware"},{"vendor":"lenovo","product":"thinkagile_hx7821_firmware"},{"vendor":"lenovo","product":"thinkagile_hx_enclosure_certified_node_firmware"},{"vendor":"lenovo","product":"thinkagile_mx1020_firmware"},{"vendor":"lenovo","product":"thinkagile_mx3330-f_firmware"},{"vendor":"lenovo","product":"thinkagile_mx3330-h_firmware"},{"vendor":"lenovo","product":"thinkagile_mx3331-f_firmware"},{"vendor":"lenovo","product":"thinkagile_mx3331-h_firmware"},{"vendor":"lenovo","product":"thinkagile_mx3530-h_firmware"},{"vendor":"lenovo","product":"thinkagile_mx3530_f_firmware"},{"vendor":"lenovo","product":"thinkagile_mx3531-f_firmware"},{"vendor":"lenovo","product":"thinkagile_vx1320_firmware"},{"vendor":"lenovo","product":"thinkagile_vx2320_firmware"},{"vendor":"lenovo","product":"thinkagile_vx2330_firmware"},{"vendor":"lenovo","product":"thinkagile_vx3320_firmware"},{"vendor":"lenovo","product":"thinkagile_vx3330_firmware"},{"vendor":"lenovo","product":"thinkagile_vx3331_firmware"},{"vendor":"lenovo","product":"thinkagile_vx3520-g_firmware"},{"vendor":"lenovo","product":"thinkagile_vx3530-g_firmware"},{"vendor":"lenovo","product":"thinkagile_vx3720_firmware"},{"vendor":"lenovo","product":"thinkagile_vx5520_firmware"},{"vendor":"lenovo","product":"thinkagile_vx5530_firmware"},{"vendor":"lenovo","product":"thinkagile_vx7320_n_firmware"},{"vendor":"lenovo","product":"thinkagile_vx7330_firmware"},{"vendor":"lenovo","product":"thinkagile_vx7520_firmware"},{"vendor":"lenovo","product":"thinkagile_vx7520_n_firmware"},{"vendor":"lenovo","product":"thinkagile_vx7530_firmware"},{"vendor":"lenovo","product":"thinkagile_vx7531_firmware"},{"vendor":"lenovo","product":"thinkagile_vx7820_firmware"},{"vendor":"lenovo","product":"thinkstation_p920_workstation_firmware"},{"vendor":"lenovo","product":"thinksystem_sd530_firmware"},{"vendor":"lenovo","product":"thinksystem_sd630_v2_firmware"},{"vendor":"lenovo","product":"thinksystem_sd650-n_v2_firmware"},{"vendor":"lenovo","product":"thinksystem_sd650_dual_node_tray_firmware"},{"vendor":"lenovo","product":"thinksystem_sd650_v3_firmware"},{"vendor":"lenovo","product":"thinksystem_sd665_v3_firmware"},{"vendor":"lenovo","product":"thinksystem_se350_firmware"},{"vendor":"lenovo","product":"thinksystem_sn550_firmware"},{"vendor":"lenovo","product":"thinksystem_sn550_v2_firmware"},{"vendor":"lenovo","product":"thinksystem_sn850_firmware"},{"vendor":"lenovo","product":"thinksystem_sr150_firmware"},{"vendor":"lenovo","product":"thinksystem_sr158_firmware"},{"vendor":"lenovo","product":"thinksystem_sr250_firmware"},{"vendor":"lenovo","product":"thinksystem_sr250_v2_firmware"},{"vendor":"lenovo","product":"thinksystem_sr258_firmware"},{"vendor":"lenovo","product":"thinksystem_sr258_v2_firmware"},{"vendor":"lenovo","product":"thinksystem_sr530_firmware"},{"vendor":"lenovo","product":"thinksystem_sr550_firmware"},{"vendor":"lenovo","product":"thinksystem_sr570_firmware"},{"vendor":"lenovo","product":"thinksystem_sr590_firmware"},{"vendor":"lenovo","product":"thinksystem_sr630_firmware"},{"vendor":"lenovo","product":"thinksystem_sr630_v2_firmware"},{"vendor":"lenovo","product":"thinksystem_sr630_v3_firmware"},{"vendor":"lenovo","product":"thinksystem_sr635_firmware"},{"vendor":"lenovo","product":"thinksystem_sr645_firmware"},{"vendor":"lenovo","product":"thinksystem_sr645_v3_firmware"},{"vendor":"lenovo","product":"thinksystem_sr650_firmware"},{"vendor":"lenovo","product":"thinksystem_sr650_v2_firmware"},{"vendor":"lenovo","product":"thinksystem_sr655_v3_firmware"},{"vendor":"lenovo","product":"thinksystem_sr665_firmware"},{"vendor":"lenovo","product":"thinksystem_sr665_v3_firmware"},{"vendor":"lenovo","product":"thinksystem_sr670_firmware"},{"vendor":"lenovo","product":"thinksystem_sr670_v2_firmware"},{"vendor":"lenovo","product":"thinksystem_sr675_v3_firmware"},{"vendor":"lenovo","product":"thinksystem_sr850_firmware"},{"vendor":"lenovo","product":"thinksystem_sr850_v2_firmware"},{"vendor":"lenovo","product":"thinksystem_sr850_v3_firmware"},{"vendor":"lenovo","product":"thinksystem_sr850p_firmware"},{"vendor":"lenovo","product":"thinksystem_sr860_firmware"},{"vendor":"lenovo","product":"thinksystem_sr860_v2_firmware"},{"vendor":"lenovo","product":"thinksystem_sr860_v3_firmware"},{"vendor":"lenovo","product":"thinksystem_sr950_firmware"},{"vendor":"lenovo","product":"thinksystem_st250_firmware"},{"vendor":"lenovo","product":"thinksystem_st250_v2_firmware"},{"vendor":"lenovo","product":"thinksystem_st258_firmware"},{"vendor":"lenovo","product":"thinksystem_st258_v2_firmware"},{"vendor":"lenovo","product":"thinksystem_st550_firmware"},{"vendor":"lenovo","product":"thinksystem_st650_v2_firmware"},{"vendor":"lenovo","product":"thinksystem_st650_v3_firmware"},{"vendor":"lenovo","product":"thinksystem_st658_v2_firmware"},{"vendor":"lenovo","product":"thinksystem_st658_v3_firmware"},{"vendor":"lenovo","product":"xclarity controller"}],"references":[{"url":"https://support.lenovo.com/us/en/product_security/LEN-156781","tags":["x_transferred"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-38512"},{"url":"https://github.com/advisories/GHSA-x3wg-9gxm-mq7c"}],"sources":{"cve":[{"id":"CVE-2024-38512","description":"A privilege escalation vulnerability was discovered in XCC that could allow an authenticated XCC user with elevated privileges to perform command injection via specially crafted IPMI commands.","status":"published","published":"2024-07-26T19:45:31.829Z","modified":"2024-08-02T04:12:25.173Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:34:16.367792Z"}],"euvd":[{"id":"EUVD-2024-37384","description":"A privilege escalation vulnerability was discovered in XCC that could allow an authenticated XCC user with elevated privileges to perform command injection via specially crafted IPMI commands.","status":"published","published":"2024-07-26T19:45:31Z","modified":"2024-08-02T04:12:25Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T03:50:18.462935Z"}],"ghsa":[{"id":"GHSA-x3wg-9gxm-mq7c","title":"A privilege escalation vulnerability was discovered in XCC that could allow an authenticated XCC...","description":"A privilege escalation vulnerability was discovered in XCC that could allow an authenticated XCC user with elevated privileges to perform command injection via specially crafted IPMI commands.","status":"published","published":"2024-07-26T21:31:16Z","modified":"2024-07-26T21:31:22Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:57:44.645006Z"}],"nvd":[{"id":"CVE-2024-38512","description":"A privilege escalation vulnerability was discovered in XCC that could allow an authenticated XCC user with elevated privileges to perform command injection via specially crafted IPMI commands.","status":"published","published":"2024-07-26T20:15:04.47Z","modified":"2026-06-17T07:40:26.633Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:10:14.437386Z"}]}}