{"id":"CVE-2024-8278","aliases":["EUVD-2024-49062","GHSA-jfrm-qx4v-5m72"],"status":"published","title":"A privilege escalation vulnerability was discovered in XCC that could allow a valid,...","description":"A privilege escalation vulnerability was discovered in XCC that could allow a valid, authenticated XCC user with elevated privileges to perform command injection via specially crafted IPMI commands.","severity":{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.01099,"percentile":0.66082,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-78"],"published":"2024-09-13T17:27:19Z","modified":"2026-06-17T08:22:15Z","products":[{"vendor":"lenovo","product":"hx enclosure certified node (thinkagile) xcc"},{"vendor":"lenovo","product":"hx1021 edge certified node 3yr (thinkagile) xcc"},{"vendor":"lenovo","product":"hx1320 appliance (thinkagile) xcc"},{"vendor":"lenovo","product":"hx1321 certified node (thinkagile) xcc"},{"vendor":"lenovo","product":"hx1331 certified node (thinkagile) xcc"},{"vendor":"lenovo","product":"hx1520-r appliance (thinkagile) xcc"},{"vendor":"lenovo","product":"hx1521-r certified node (thinkagile) xcc"},{"vendor":"lenovo","product":"hx2320-e appliance (thinkagile) xcc"},{"vendor":"lenovo","product":"hx2321 certified node (thinkagile) xcc"},{"vendor":"lenovo","product":"hx2330 appliance (thinkagile) xcc"},{"vendor":"lenovo","product":"hx2331 certified node (thinkagile) xcc"},{"vendor":"lenovo","product":"hx2720-e appliance (thinkagile) xcc"},{"vendor":"lenovo","product":"hx3320 appliance (thinkagile) xcc"},{"vendor":"lenovo","product":"hx3321 certified node (thinkagile) xcc"},{"vendor":"lenovo","product":"hx3330 appliance (thinkagile) xcc"},{"vendor":"lenovo","product":"hx3331 certified node (thinkagile) xcc"},{"vendor":"lenovo","product":"hx3331 node sap hana (thinkagile) xcc"},{"vendor":"lenovo","product":"hx3375 appliance (thinkagile) xcc"},{"vendor":"lenovo","product":"hx3376 certified node (thinkagile) xcc"},{"vendor":"lenovo","product":"hx3520-g appliance (thinkagile) xcc"},{"vendor":"lenovo","product":"hx3521-g certified node (thinkagile) xcc"},{"vendor":"lenovo","product":"hx3720 appliance (thinkagile) xcc"},{"vendor":"lenovo","product":"hx3721 certified node (thinkagile) xcc"},{"vendor":"lenovo","product":"hx5520 appliance (thinkagile) xcc"},{"vendor":"lenovo","product":"hx5520-c appliance (thinkagile) xcc"},{"vendor":"lenovo","product":"hx5521 certified node (thinkagile) xcc"},{"vendor":"lenovo","product":"hx5521-c certified node (thinkagile) xcc"},{"vendor":"lenovo","product":"hx5530 appliance (thinkagile) xcc"},{"vendor":"lenovo","product":"hx5531 certified node (thinkagile) xcc"},{"vendor":"lenovo","product":"hx7520 appliance (thinkagile) xcc"},{"vendor":"lenovo","product":"hx7521 certified node (thinkagile) xcc"},{"vendor":"lenovo","product":"hx7530 appl for sap hana (thinkagile) xcc"},{"vendor":"lenovo","product":"hx7530 appliance (thinkagile) xcc"},{"vendor":"lenovo","product":"hx7531 certified node (thinkagile) xcc"},{"vendor":"lenovo","product":"hx7531 node sap hana (thinkagile) xcc"},{"vendor":"lenovo","product":"hx7820 appliance (thinkagile) xcc"},{"vendor":"lenovo","product":"hx7821 certified node (thinkagile) xcc"},{"vendor":"lenovo","product":"mx edge appliance - mx1020 (thinkagile) xcc"},{"vendor":"lenovo","product":"mx3330-f all-flash appliance (thinkagile) xcc"},{"vendor":"lenovo","product":"mx3330-h hybrid appliance (thinkagile) xcc"},{"vendor":"lenovo","product":"mx3331-f all-flash certified node (thinkagile) xcc"},{"vendor":"lenovo","product":"mx3331-h hybrid certified node (thinkagile) xcc"},{"vendor":"lenovo","product":"mx3530 f all flash appliance (thinkagile) xcc"},{"vendor":"lenovo","product":"mx3530-h hybrid appliance (thinkagile) xcc"},{"vendor":"lenovo","product":"mx3531 h hybrid certified node (thinkagile) xcc"},{"vendor":"lenovo","product":"mx3531-f all-flash certified node (thinkagile) xcc"},{"vendor":"lenovo","product":"p920 rack workstation (thinkstation) xcc"},{"vendor":"lenovo","product":"sd530 (thinksystem) xcc"},{"vendor":"lenovo","product":"sd530 v3 (thinksystem) xcc"},{"vendor":"lenovo","product":"sd550 v3 (thinksystem) xcc"},{"vendor":"lenovo","product":"sd630 v2 (thinksystem) xcc"},{"vendor":"lenovo","product":"sd650 dwc dual node tray (thinksystem) xcc"},{"vendor":"lenovo","product":"sd650 v2 (thinksystem) xcc"},{"vendor":"lenovo","product":"sd650 v3 (thinksystem) xcc"},{"vendor":"lenovo","product":"sd650-n v2 (thinksystem) xcc"},{"vendor":"lenovo","product":"sd665 v3 (thinksystem) xcc"},{"vendor":"lenovo","product":"se350 (thinksystem) xcc"},{"vendor":"lenovo","product":"se350 v2 (thinkedge) xcc"},{"vendor":"lenovo","product":"se360 v2 (thinkedge) xcc"},{"vendor":"lenovo","product":"se450 (thinkedge) xcc"},{"vendor":"lenovo","product":"se455 v3 (thinkedge) xcc"},{"vendor":"lenovo","product":"sn550 (thinksystem) xcc"},{"vendor":"lenovo","product":"sn550 v2 (thinksystem) xcc"},{"vendor":"lenovo","product":"sn850 (thinksystem) xcc"},{"vendor":"lenovo","product":"sr150 (thinksystem) xcc"},{"vendor":"lenovo","product":"sr158 (thinksystem) xcc"},{"vendor":"lenovo","product":"sr250 (thinksystem) xcc"},{"vendor":"lenovo","product":"sr250 v2 (thinksystem) xcc"},{"vendor":"lenovo","product":"sr250 v3 (thinksystem) xcc"},{"vendor":"lenovo","product":"sr258 (thinksystem) xcc"},{"vendor":"lenovo","product":"sr258 v2 (thinksystem) xcc"},{"vendor":"lenovo","product":"sr258 v3 (thinksystem) xcc"},{"vendor":"lenovo","product":"sr530 (thinksystem) xcc"},{"vendor":"lenovo","product":"sr550 (thinksystem) xcc"},{"vendor":"lenovo","product":"sr570  (thinksystem) xcc"},{"vendor":"lenovo","product":"sr590 (thinksystem) xcc"},{"vendor":"lenovo","product":"sr630  (thinksystem) xcc"},{"vendor":"lenovo","product":"sr630 v2 (thinksystem) xcc"},{"vendor":"lenovo","product":"sr630 v3 (thinksystem) xcc"},{"vendor":"lenovo","product":"sr635 v3 (thinksystem) xcc"},{"vendor":"lenovo","product":"sr645 (thinksystem) xcc"},{"vendor":"lenovo","product":"sr645 v3 (thinksystem) xcc"},{"vendor":"lenovo","product":"sr650  (thinksystem) xcc"},{"vendor":"lenovo","product":"sr650 v2 (thinksystem) xcc"},{"vendor":"lenovo","product":"sr650 v3 (thinksystem) xcc"},{"vendor":"lenovo","product":"sr655 v3 (thinksystem) xcc"},{"vendor":"lenovo","product":"sr665 (thinksystem) xcc"},{"vendor":"lenovo","product":"sr665 v3 (thinksystem) xcc"},{"vendor":"lenovo","product":"sr670 (thinksystem) xcc"},{"vendor":"lenovo","product":"sr670 v2 (thinksystem) xcc"},{"vendor":"lenovo","product":"sr675 v3 (thinksystem) xcc"},{"vendor":"lenovo","product":"sr850 (thinksystem) xcc"},{"vendor":"lenovo","product":"sr850 v2 (thinksystem) xcc"},{"vendor":"lenovo","product":"sr850 v3 (thinksystem) xcc"},{"vendor":"lenovo","product":"sr850p (thinksystem) xcc"},{"vendor":"lenovo","product":"sr860 (thinksystem) xcc"},{"vendor":"lenovo","product":"sr860 v2 (thinksystem) xcc"},{"vendor":"lenovo","product":"sr860 v3 (thinksystem) xcc"},{"vendor":"lenovo","product":"sr950 (thinksystem) xcc"},{"vendor":"lenovo","product":"sr950 v3 (thinksystem) xcc"},{"vendor":"lenovo","product":"st250 (thinksystem) xcc"},{"vendor":"lenovo","product":"st250 v2 (thinksystem) xcc"},{"vendor":"lenovo","product":"st250 v3 (thinksystem) xcc"},{"vendor":"lenovo","product":"st258 (thinksystem) xcc"},{"vendor":"lenovo","product":"st258 v2 (thinksystem) xcc"},{"vendor":"lenovo","product":"st258 v3 (thinksystem) xcc"},{"vendor":"lenovo","product":"st550 (thinksystem) xcc"},{"vendor":"lenovo","product":"st650 v2 (thinksystem) xcc"},{"vendor":"lenovo","product":"st650 v3 (thinksystem) xcc"},{"vendor":"lenovo","product":"st658 v2 (thinksystem) xcc"},{"vendor":"lenovo","product":"st658 v3 (thinksystem) xcc"},{"vendor":"lenovo","product":"thinkagile mx1021 on se350 xcc"},{"vendor":"lenovo","product":"thinkagile_hx1021_edge_certified_node_3yr_firmware"},{"vendor":"lenovo","product":"thinkagile_hx1320_firmware"},{"vendor":"lenovo","product":"thinkagile_hx3375_firmware"},{"vendor":"lenovo","product":"thinkagile_hx7530_firmware"},{"vendor":"lenovo","product":"thinkagile_hx7820_firmware"},{"vendor":"lenovo","product":"thinkagile_hx_enclosure_certified_node_firmware"},{"vendor":"lenovo","product":"thinkedge_se350_v2_firmware"},{"vendor":"lenovo","product":"thinkedge_se450__firmware"},{"vendor":"lenovo","product":"thinkedge_se455_v3_firmware"},{"vendor":"lenovo","product":"thinksystem_sd530_v3_firmware"},{"vendor":"lenovo","product":"thinksystem_sd630_v2_firmware"},{"vendor":"lenovo","product":"thinksystem_sr630_v3_firmware"},{"vendor":"lenovo","product":"thinksystem_sr635_v3_firmware"},{"vendor":"lenovo","product":"thinksystem_sr675_v3_firmware"},{"vendor":"lenovo","product":"thinksystem_sr850_v3_firmware"},{"vendor":"lenovo","product":"thinksystem_sr950_v3_firmware"},{"vendor":"lenovo","product":"thinksystem_st250_v3_firmware"},{"vendor":"lenovo","product":"thinksystem_st650_v3_firmware"},{"vendor":"lenovo","product":"vx 1se certified node (thinkagile) xcc"},{"vendor":"lenovo","product":"vx 2u4n certified node (thinkagile) xcc"},{"vendor":"lenovo","product":"vx 4u certified node (thinkagile) xcc"},{"vendor":"lenovo","product":"vx1320 (thinkagile) xcc"},{"vendor":"lenovo","product":"vx2320 (thinkagile) xcc"},{"vendor":"lenovo","product":"vx2330 appliance (thinkagile) xcc"},{"vendor":"lenovo","product":"vx3320 (thinkagile) xcc"},{"vendor":"lenovo","product":"vx3330 appliance (thinkagile) xcc"},{"vendor":"lenovo","product":"vx3331 certified node (thinkagile) xcc"},{"vendor":"lenovo","product":"vx3520-g (thinkagile) xcc"},{"vendor":"lenovo","product":"vx3530-g appliance (thinkagile) xcc"},{"vendor":"lenovo","product":"vx3720 (thinkagile) xcc"},{"vendor":"lenovo","product":"vx5520 (thinkagile) xcc"},{"vendor":"lenovo","product":"vx5530 appliance (thinkagile) xcc"},{"vendor":"lenovo","product":"vx635 v3 integrated system (thinkagile) xcc"},{"vendor":"lenovo","product":"vx645 v3 certified node (thinkagile) xcc"},{"vendor":"lenovo","product":"vx645 v3 integrated system (thinkagile) xcc"},{"vendor":"lenovo","product":"vx655 v3 certified node (thinkagile) xcc"},{"vendor":"lenovo","product":"vx655 v3 integrated system (thinkagile) xcc"},{"vendor":"lenovo","product":"vx665 v3 certified node (thinkagile) xcc"},{"vendor":"lenovo","product":"vx665 v3 integrated system (thinkagile) xcc"},{"vendor":"lenovo","product":"vx7320 n (thinkagile) xcc"},{"vendor":"lenovo","product":"vx7330 appliance (thinkagile) xcc"},{"vendor":"lenovo","product":"vx7520 (thinkagile) xcc"},{"vendor":"lenovo","product":"vx7520 n (thinkagile) xcc"},{"vendor":"lenovo","product":"vx7530 appliance (thinkagile) xcc"},{"vendor":"lenovo","product":"vx7531 certified node (thinkagile) xcc"},{"vendor":"lenovo","product":"vx7820 (thinkagile) xcc"}],"references":[{"url":"https://support.lenovo.com/us/en/product_security/LEN-172051"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-8278"},{"url":"https://github.com/advisories/GHSA-jfrm-qx4v-5m72"}],"sources":{"cve":[{"id":"CVE-2024-8278","description":"A privilege escalation vulnerability was discovered in XCC that could allow a valid, authenticated XCC user with elevated privileges to perform command injection via specially crafted IPMI commands.","status":"published","published":"2024-09-13T17:27:19.968Z","modified":"2024-09-13T21:02:31.667Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:34:08.843708Z"}],"euvd":[{"id":"EUVD-2024-49062","description":"A privilege escalation vulnerability was discovered in XCC that could allow a valid, authenticated XCC user with elevated privileges to perform command injection via specially crafted IPMI commands.","status":"published","published":"2024-09-13T17:27:19Z","modified":"2024-09-13T21:02:31Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T00:55:55.02611Z"}],"ghsa":[{"id":"GHSA-jfrm-qx4v-5m72","title":"A privilege escalation vulnerability was discovered in XCC that could allow a valid,...","description":"A privilege escalation vulnerability was discovered in XCC that could allow a valid, authenticated XCC user with elevated privileges to perform command injection via specially crafted IPMI commands.","status":"published","published":"2024-09-13T18:31:48Z","modified":"2024-09-13T18:31:56Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:58:15.804018Z"}],"nvd":[{"id":"CVE-2024-8278","description":"A privilege escalation vulnerability was discovered in XCC that could allow a valid, authenticated XCC user with elevated privileges to perform command injection via specially crafted IPMI commands.","status":"published","published":"2024-09-13T18:15:06.703Z","modified":"2026-06-17T08:22:15.03Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:10:26.717759Z"}]}}