high8.1
CVE-2023-4606
An authenticated XCC user with Read-Only permission can change a different user’s password through a crafted API command.
Impact
An authenticated XCC user with Read-Only permission can change a different user’s password through a crafted API command. This affects ThinkSystem v2 and v3 servers with XCC; ThinkSystem v1 servers are not affected.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Lenovo | Thinkagile Hx5530 Firmware | All versions |
| Lenovo | Thinkagile Hx7530 Firmware | All versions |
| Lenovo | Thinkagile Vx3331 Firmware | All versions |
| Lenovo | Thinkagile Hx1331 Firmware | All versions |
| Lenovo | Thinkagile Hx2330 Firmware | All versions |
| Lenovo | Thinkagile Hx2331 Firmware | All versions |
| Lenovo | Thinkagile Hx3330 Firmware | All versions |
| Lenovo | Thinkagile Hx3331 Firmware | All versions |
| Lenovo | Thinkagile Hx3375 Firmware | All versions |
| Lenovo | Thinkagile Hx3376 Firmware | All versions |
| Lenovo | Thinkagile Hx5531 Firmware | All versions |
| Lenovo | Thinkagile Hx7531 Firmware | All versions |