The vulnerability of the Lenovo XClarity Controller (XCC) for Lenovo ThinkSystem servers arises from the lack of measures taken to neutralize specific elements, allowing a perpetrator to execute arbitrary commands.

🗓️ 13 Jan 2025 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec

bdu_fstec🔗 bdu.fstec.ru👁 6 Views

Lenovo XClarity Controller flaw enables command execution on ThinkSystem servers via created files.

Reporter	Title	Published	Views	Family All 10
Circl	CVE-2024-38510	26 Jul 202423:03	–	circl
CNNVD	Lenovo XClarity Controller 安全漏洞	26 Jul 202400:00	–	cnnvd
CVE	CVE-2024-38510	26 Jul 202419:45	–	cve
Cvelist	CVE-2024-38510	26 Jul 202419:45	–	cvelist
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in XCC affect Cloud Pak System	28 Oct 202418:04	–	ibm
EUVD	EUVD-2024-37382	3 Oct 202520:07	–	euvd
NVD	CVE-2024-38510	26 Jul 202420:15	–	nvd
Positive Technologies	PT-2024-10055 · Lenovo · Lenovo Xclarity Controller	9 Jul 202400:00	–	ptsecurity
RedhatCVE	CVE-2024-38510	5 Feb 202508:58	–	redhatcve
Vulnrichment	CVE-2024-38510	26 Jul 202419:45	–	vulnrichment

Vulners

Node

lenovo_group hx5530_appliance_(thinkagile)Range<4.71

OR

lenovo_group hx7530_appl_for_sap_hana_(thinkagile)Range<4.71

OR

lenovo_group vx3331_certified_node_(thinkagile)Range<4.71

OR

lenovo_group hx1331_certified_node_(thinkagile)Range<4.71

OR

lenovo_group hx2330_appliance_(thinkagile)Range<4.71

OR

lenovo_group hx2331_certified_node_(thinkagile)Range<4.71

OR

lenovo_group hx3330_appliance_(thinkagile)Range<4.71

OR

lenovo_group hx3331_certified_node_(thinkagile)Range<4.71

OR

lenovo_group hx3331_node_sap_hana_(thinkagile)Range<4.71

OR

lenovo_group hx5531_certified_node_(thinkagile)Range<4.71

OR

lenovo_group vx7531_certified_nodeRange<4.71

OR

lenovo_group hx7531_node_sap_hana_(thinkagile)Range<4.71

OR

lenovo_group mx3330-f_all-flash_appliance_(thinkagile)Range<4.71

OR

lenovo_group mx3330-h_hybrid_appliance_(thinkagile)Range<4.71

OR

lenovo_group mx3331-f_all-flash_certified_node_(thinkagile)Range<4.71

OR

lenovo_group mx3331-h_hybrid_certified_node_(thinkagile)Range<4.71

OR

lenovo_group mx3530_f_all_flash_appliance_(thinkagile)Range<4.71

OR

lenovo_group mx3530-h_hybrid_appliance_(thinkagile)Range<4.71

OR

lenovo_group mx3531_h_hybrid_certified_node_(thinkagile)Range<4.71

OR

lenovo_group vx2330_appliance_(thinkagile)Range<4.71

OR

lenovo_group vx3330_appliance_(thinkagile)Range<4.71

OR

lenovo_group vx3530-g_appliance_(thinkagile)Range<4.71

OR

lenovo_group vx5530_appliance_(thinkagile)Range<4.71

OR

lenovo_group vx7330_appliance_(thinkagile)Range<4.71

OR

lenovo_group vx7530_appliance_(thinkagile)Range<4.71

OR

lenovo_group vx7531_certified_node_(thinkagile)Range<4.71

OR

lenovo_group sr630_v2_(thinksystem)Range<4.71

OR

lenovo_group sr650_v2_(thinksystem)Range<4.71

Source	Link
support	www.support.lenovo.com/vn/en/product_security/ps500634-lenovo-xclarity-controller-xcc-vulnerabilities
web	www.web.nvd.nist.gov/view/vuln/detail

19 Jan 2025 00:00Current

7.5High risk

Vulners AI Score7.5

CVSS 37.2

CVSS 29

EPSS0.01071

Lenovo XClarity Controller ThinkSystem servers arbitrary command execution created files vulnerability