CVE-2023-29057
HIGHLenovo ThinkAgile HX Series Firmware - Privilege Escalation via LDAP Local Account Permission Override
Title source: llmDescription
A valid XCC user's local account permissions overrides their active directory permissions under specific configurations. This could lead to a privilege escalation. To be vulnerable, LDAP must be configured for authentication/authorization and logins configured as “Local First, then LDAP”.
References (1)
Core 1
Core References
Vendor Advisory
https://support.lenovo.com/us/en/product_security/LEN-118321
Scores
CVSS v3
7.3
EPSS
0.0027
EPSS Percentile
50.5%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
total
Details
CWE
CWE-276
Status
published
Products (50)
lenovo/thinkagile_hx1021_firmware
< 3.72_tei388s
lenovo/thinkagile_hx1320_firmware
< 8.88_cdi3a4a
lenovo/thinkagile_hx1321_firmware
< 8.88_cdi3a4a
lenovo/thinkagile_hx1331_firmware
< 2.93_afbt30p
lenovo/thinkagile_hx1520-r_firmware
< 8.88_cdi3a4a
lenovo/thinkagile_hx1521-r_firmware
< 8.88_cdi3a4a
lenovo/thinkagile_hx2320-e_firmware
< 8.88_cdi3a4a
lenovo/thinkagile_hx2321_firmware
< 8.88_cdi3a4a
lenovo/thinkagile_hx2330_firmware
2.93_afbt30p
lenovo/thinkagile_hx2330_firmware
< 2.93_afbt30p
... and 40 more
Published
Apr 28, 2023
Tracked Since
Feb 18, 2026