CVE-2024-8281 describes an input validation weakness in XCC, allowing authenticated users with elevated privileges to achieve command injection via specially crafted command line input within the XCC SSH captive shell. This vulnerability carries a CVSS score of 7.2 (HIGH), indicating a network-based attack with low complexity, requiring high privileges, and potentially leading to high impact on confidentiality, integrity, and availability. Currently, there is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage surrounding this CVE.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
| Lenovo | HX Enclosure Certified Node (ThinkAgile) XCC | >= 0, < 6.36 TEI3F4ACNA affecteddefault unaffected | |
| Lenovo | HX1021 Edge Certified Node 3yr (ThinkAgile) XCC | >= 0, < 4.11 TEI3E4ACNA affecteddefault unaffected | |
| Lenovo | HX1320 Appliance (ThinkAgile) XCC | >= 0, < 9.97 CDI3B4BCNA affecteddefault unaffected | |
| Lenovo | HX1321 Certified Node (ThinkAgile) XCC | >= 0, < 9.97 CDI3B4BCNA affecteddefault unaffected | |
| Lenovo | HX1331 Certified Node (ThinkAgile) XCC | >= 0, < 4.71 AFBT48CCNA affecteddefault unaffected |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.3 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.