CVE-2024-38509

Published Jul 26, 2024 CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed
Description
A privilege escalation vulnerability was discovered in XCC that could allow an authenticated XCC user with elevated privileges to execute arbitrary code via a specially crafted IPMI command.

Remediation

Vendor Solution

Update to the version (or newer) indicated for your model in the Product Impact section in the advisory: https://support.lenovo.com/us/en/product_security/LEN-156781

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
EUVD EUVD EUVD-2024-37381 A privilege escalation vulnerability was discovered in XCC that could allow an authenticated XCC user with elevated privileges to execute arbitrary code via a specially crafted IPMI command.
History

No history.

Subscriptions

No data.

Weaknesses

Sources

Status
PUBLISHED
Assigner
lenovo
Published
Updated
Aug 2, 2024, 4:12 AM
Reserved
Jun 18, 2024, 2:42 PM
Status
Deferred
Published
Jul 26, 2024, 8:15 PM
Modified
Jun 17, 2026, 7:40 AM