CVE-2024-38508
HIGHLenovo XClarity Controller - Authenticated OS Command Injection via Web Interface or SSH Captive Shell
Title source: llmDescription
A privilege escalation vulnerability was discovered in the web interface or SSH captive command shell interface of XCC that could allow an authenticated XCC user with elevated privileges to perform command injection via a specially crafted request.
References (1)
Core 1
Core References
Various Sources
https://support.lenovo.com/us/en/product_security/LEN-156781
Scores
CVSS v3
7.2
EPSS
0.0050
EPSS Percentile
66.4%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
total
Details
CWE
CWE-78
Status
published
Products (1)
Lenovo/XClarity Controller
various
Published
Jul 26, 2024
Tracked Since
Feb 18, 2026