CVE-2023-25495: Medium severity lenovo thinkagile hx5530 firmware vulnerability
Published Apr 28, 2023
·Updated
A valid, authenticated administrative user can query a web interface API to reveal the configured LDAP client password used by XCC to authenticate to an external LDAP server in certain configurations. There is no exposure where no LDAP client password is configured
Affected Software
221 affected components
Lenovo Thinkagile Hx5530 Firmware<2.93_afbt30p
Lenovo Thinkagile Hx5530
Lenovo Thinkagile Hx7530 Firmware<2.93_afbt30p
Lenovo Thinkagile Hx7530
Lenovo Thinkagile Vx3331 Firmware<2.93_afbt30p
Lenovo Thinkagile Vx3331
Lenovo Thinkagile Hx Enclosure Firmware<3.72_tei388s
Lenovo Thinkagile Hx Enclosure
Lenovo Thinkagile Hx1021 Firmware<3.72_tei388s
Lenovo Thinkagile Hx1021
Lenovo Thinkagile Hx1320 Firmware<8.88_cdi3a4a
Lenovo Thinkagile Hx1320
Lenovo Thinkagile Hx1321 Firmware<8.88_cdi3a4a
Lenovo Thinkagile Hx1321
Lenovo Thinkagile Hx1331 Firmware<2.93_afbt30p
Lenovo Thinkagile Hx1331
Lenovo Thinkagile Hx1520-r Firmware<8.88_cdi3a4a
Lenovo Thinkagile Hx1520-r
Lenovo Thinkagile Hx1521-r Firmware<8.88_cdi3a4a
Lenovo Thinkagile Hx1521-r
Lenovo Thinkagile Hx2320-e Firmware<8.88_cdi3a4a
Lenovo Thinkagile Hx2320-e
Lenovo Thinkagile Hx2321 Firmware<8.88_cdi3a4a
Lenovo Thinkagile Hx2321
Lenovo Thinkagile Hx2330 Firmware<2.93_afbt30p
Lenovo Thinkagile Hx2330 Firmware=2.93_afbt30p
Lenovo Thinkagile Hx2330
Lenovo Thinkagile Hx2331 Firmware<2.93_afbt30p
Lenovo Thinkagile Hx2331
Lenovo Thinkagile Hx2720-e Firmware<3.72_tei388s
Lenovo Thinkagile Hx2720-e
Lenovo Thinkagile Hx3320 Firmware<8.88_cdi3a4a
Lenovo Thinkagile Hx3320
Lenovo Thinkagile Hx3321 Firmware<8.88_cdi3a4a
Lenovo Thinkagile Hx3321
Lenovo Thinkagile Hx3330 Firmware<2.93_afbt30p
Lenovo Thinkagile Hx3330
Lenovo Thinkagile Hx3331 Firmware<2.93_afbt30p
Lenovo Thinkagile Hx3331
Lenovo Thinkagile Hx3331 Firmware<4.71_d8bt48p
Lenovo Thinkagile Hx3375 Firmware<4.71_d8bt48p
Lenovo Thinkagile Hx3375
Lenovo Thinkagile Hx3376 Firmware<8.88_cdi3a4a
Lenovo Thinkagile Hx3376
Lenovo Thinkagile Hx3520-g Firmware<8.88_cdi3a4a
Lenovo Thinkagile Hx3520-g
Lenovo Thinkagile Hx3521-g Firmware<3.72_tei388s
Lenovo Thinkagile Hx3521-g
Lenovo Thinkagile Hx3720 Firmware<3.72_tei388s
Lenovo Thinkagile Hx3720
Lenovo Thinkagile Hx3721 Firmware<8.88_cdi3a4a
Lenovo Thinkagile Hx3721
Lenovo Thinkagile Hx5520 Firmware<8.88_cdi3a4a
Lenovo Thinkagile Hx5520
Lenovo Thinkagile Hx5520-c Firmware<8.88_cdi3a4a
Lenovo Thinkagile Hx5520-c
Lenovo Thinkagile Hx5521 Firmware<8.88_cdi3a4a
Lenovo Thinkagile Hx5521
Lenovo Thinkagile Hx5521-c Firmware<2.93_afbt30p
Lenovo Thinkagile Hx5521-c
Lenovo Thinkagile Hx5531 Firmware<8.88_cdi3a4a
Lenovo Thinkagile Hx5531
Lenovo Thinkagile Hx7520 Firmware<8.88_cdi3a4a
Lenovo Thinkagile Hx7520
Lenovo Thinkagile Hx7521 Firmware<2.93_afbt30p
Lenovo Thinkagile Hx7521
Lenovo Thinkagile Hx7531 Firmware<2.93_afbt30p
Lenovo Thinkagile Hx7531
Lenovo Thinkagile Hx7531 Firmware<2.75_psi348s
Lenovo Thinkagile Hx7820 Firmware<2.75_psi348s
Lenovo Thinkagile Hx7820
Lenovo Thinkagile Hx7821 Firmware<3.72_tei388s
Lenovo Thinkagile Hx7821
Lenovo Thinkagile Mx1020 Firmware<2.93_afbt30p
Lenovo Thinkagile Mx1020
Lenovo Thinkagile Mx3330-f Firmware<2.93_afbt30p
Lenovo Thinkagile Mx3330-f
Lenovo Thinkagile Mx3330-h Firmware<2.93_afbt30p
Lenovo Thinkagile Mx3330-h
Lenovo Thinkagile Mx3331-f Firmware<2.93_afbt30p
Lenovo Thinkagile Mx3331-f
Lenovo Thinkagile Mx3331-h Firmware<2.93_afbt30p
Lenovo Thinkagile Mx3331-h
Lenovo Thinkagile Mx3530 F Firmware<2.93_afbt30p
Lenovo Thinkagile Mx3530 F
Lenovo Thinkagile Mx3530-h Firmware<2.93_afbt30p
Lenovo Thinkagile Mx3530-h
Lenovo Thinkagile Mx3531 H Firmware<2.93_afbt30p
Lenovo Thinkagile Mx3531 H
Lenovo Thinkagile Mx3531-f Firmware<3.72_tei388s
Lenovo Thinkagile Mx3531-f
Lenovo Thinkagile Mx1021 On Se350 Firmware<3.72_tei388s
Lenovo Thinkagile Mx1021 On Se350
Lenovo Thinkagile Vx 1se Firmware<3.72_tei388s
Lenovo Thinkagile Vx 1se
Lenovo Thinkagile Vx 2u4n Firmware<3.72_tei388s
Lenovo Thinkagile Vx 2u4n
Lenovo Thinkagile Vx 4u Firmware<2.75_psi348s
Lenovo Thinkagile Vx 4u
Lenovo Thinkagile Vx1320 Firmware<3.72_tei388s
Lenovo Thinkagile Vx1320
Lenovo Thinkagile Vx2320 Firmware<8.88_cdi3a4a
Lenovo Thinkagile Vx2320
Lenovo Thinkagile Vx2330 Firmware<2.93_afbt30p
Lenovo Thinkagile Vx2330
Lenovo Thinkagile Vx3320 Firmware<8.88_cdi3a4a
Lenovo Thinkagile Vx3320
Lenovo Thinkagile Vx3330 Firmware<2.93_afbt30p
Lenovo Thinkagile Vx3330
Lenovo Thinkagile Vx3520-g Firmware<8.88_cdi3a4a
Lenovo Thinkagile Vx3520-g
Lenovo Thinkagile Vx3530-g Firmware<2.93_afbt30p
Lenovo Thinkagile Vx3530-g
Lenovo Thinkagile Vx3720 Firmware<3.72_tei388s
Lenovo Thinkagile Vx3720
Lenovo Thinkagile Vx5520 Firmware<8.88_cdi3a4a
Lenovo Thinkagile Vx5520
Lenovo Thinkagile Vx5530 Firmware<2.93_afbt30p
Lenovo Thinkagile Vx5530
Lenovo Thinkagile Vx7320 N Firmware<8.88_cdi3a4a
Lenovo Thinkagile Vx7320 N
Lenovo Thinkagile Vx7330 Firmware<2.93_afbt30p
Lenovo Thinkagile Vx7330
Lenovo Thinkagile Vx7520 Firmware<8.88_cdi3a4a
Lenovo Thinkagile Vx7520
Lenovo Thinkagile Vx7520 N Firmware<8.88_cdi3a4a
Lenovo Thinkagile Vx7520 N
Lenovo Thinkagile Vx7530 Firmware<2.93_afbt30p
Lenovo Thinkagile Vx7530
Lenovo Thinkagile Vx7531 Firmware<2.93_afbt30p
Lenovo Thinkagile Vx7531
Lenovo Thinkagile Vx7820 Firmware<2.75_psi348s
Lenovo Thinkagile Vx7820
Lenovo Thinkedge Se450 Firmware<1.60_usx324o
Lenovo Thinkedge Se450
Lenovo Thinkstation P920 Firmware<8.88_cdi3a4a
Lenovo Thinkstation P920
Lenovo Thinksystem Sd530 Firmware<3.72_tei388s
Lenovo Thinksystem Sd530
Lenovo Thinksystem Sd630 V2 Firmware<2.60_tgbt42h
Lenovo Thinksystem Sd630 V2
Lenovo Thinksystem Sd650 Firmware<3.72_tei388s
Lenovo Thinksystem Sd650
Lenovo Thinksystem Sd650 V2 Firmware<2.60_tgbt42h
Lenovo Thinksystem Sd650 V2
Lenovo Thinksystem Sd650-n V2 Firmware<2.60_tgbt42h
Lenovo Thinksystem Sd650-n V2
Lenovo Thinksystem Se350 Firmware<3.72_tei388s
Lenovo Thinksystem Se350
Lenovo Thinksystem Sn550 Firmware<3.72_tei388s
Lenovo Thinksystem Sn550
Lenovo Thinksystem Sn550 V2 Firmware<2.60_tgbt42h
Lenovo Thinksystem Sn550 V2
Lenovo Thinksystem Sn850 Firmware<3.72_tei388s
Lenovo Thinksystem Sn850
Lenovo Thinksystem Sr150 Firmware<3.72_tei388s
Lenovo Thinksystem Sr150
Lenovo Thinksystem Sr158 Firmware<3.72_tei388s
Lenovo Thinksystem Sr158
Lenovo Thinksystem Sr250 Firmware<3.72_tei388s
Lenovo Thinksystem Sr250
Lenovo Thinksystem Sr250 V2 Firmware<2.60_tgbt42h
Lenovo Thinksystem Sr250 V2
Lenovo Thinksystem Sr258 Firmware<3.72_tei388s
Lenovo Thinksystem Sr258
Lenovo Thinksystem Sr258 V2 Firmware<2.60_tgbt42h
Lenovo Thinksystem Sr258 V2
Lenovo Thinksystem Sr530 Firmware<8.88_cdi3a4a
Lenovo Thinksystem Sr530
Lenovo Thinksystem Sr550 Firmware<8.88_cdi3a4a
Lenovo Thinksystem Sr550
Lenovo Thinksystem Sr570 Firmware<8.88_cdi3a4a
Lenovo Thinksystem Sr570
Lenovo Thinksystem Sr590 Firmware<8.88_cdi3a4a
Lenovo Thinksystem Sr590
Lenovo Thinksystem Sr630 Firmware<8.88_cdi3a4a
Lenovo Thinksystem Sr630
Lenovo Thinksystem Sr630 V2 Firmware<2.93_afbt30p
Lenovo Thinksystem Sr630 V2
Lenovo Thinksystem Sr645 Firmware<4.71_d8bt48p
Lenovo Thinksystem Sr645
Lenovo Thinksystem Sr645 V3 Firmware<4.71_d8bt48p
Lenovo Thinksystem Sr645 V3
Lenovo Thinksystem Sr650 Firmware<8.88_cdi3a4a
Lenovo Thinksystem Sr650
Lenovo Thinksystem Sr650 V2 Firmware<2.93_afbt30p
Lenovo Thinksystem Sr650 V2
Lenovo Thinksystem Sr665 Firmware<4.71_d8bt48p
Lenovo Thinksystem Sr665
Lenovo Thinksystem Sr665 V3 Firmware<4.71_d8bt48p
Lenovo Thinksystem Sr665 V3
Lenovo Thinksystem Sr670 Firmware<3.72_tei388s
Lenovo Thinksystem Sr670
Lenovo Thinksystem Sr670 V2 Firmware<2.60_tgbt42h
Lenovo Thinksystem Sr670 V2
Lenovo Thinksystem Sr850 Firmware<3.72_tei388s
Lenovo Thinksystem Sr850
Lenovo Thinksystem Sr850 V2 Firmware<2.60_tgbt42h
Lenovo Thinksystem Sr850 V2
Lenovo Thinksystem Sr850p Firmware<3.72_tei388s
Lenovo Thinksystem Sr850p
Lenovo Thinksystem Sr860 Firmware<3.72_tei388s
Lenovo Thinksystem Sr860
Lenovo Thinksystem Sr860 V2 Firmware<2.60_tgbt42h
Lenovo Thinksystem Sr860 V2
Lenovo Thinksystem Sr950 Firmware<2.75_psi348s
Lenovo Thinksystem Sr950
Lenovo Thinksystem St250 Firmware<3.72_tei388s
Lenovo Thinksystem St250
Lenovo Thinksystem St250 V2 Firmware<2.60_tgbt42h
Lenovo Thinksystem St250 V2
Lenovo Thinksystem St258 Firmware<3.72_tei388s
Lenovo Thinksystem St258
Lenovo Thinksystem St258 V2 Firmware<2.60_tgbt42h
Lenovo Thinksystem St258 V2
Lenovo Thinksystem St550 Firmware<8.88_cdi3a4a
Lenovo Thinksystem St550
Lenovo Thinksystem St650 V2 Firmware<2.60_tgbt42h
Lenovo Thinksystem St650 V2
Lenovo Thinksystem St658 V2 Firmware<2.60_tgbt42h
Lenovo Thinksystem St658 V2
Remediation
Information
Customers should update to the version (or later) of Lenovo XClarity Controller (XCC) identified in the related Lenovo Product Security Advisory: https://support.lenovo.com/us/en/product_security/LEN-99936 https://support.lenovo.com/us/en/product_security/LEN-99936
Event History
Apr 28, 2023
CVE Published
via MITRE·09:26 PM
Data Sourced
via MITRE·09:26 PM
RemedyDescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2023-25495?
The severity of CVE-2023-25495 is considered moderate, as it allows an authenticated administrative user to expose sensitive LDAP client passwords.
2
How do I fix CVE-2023-25495?
To fix CVE-2023-25495, update the firmware to versions later than 2.93_afbt30p or 3.72_tei388s based on your system model.
3
Which firmware versions are affected by CVE-2023-25495?
CVE-2023-25495 affects specific Lenovo ThinkAgile firmware versions including 2.93_afbt30p and 3.72_tei388s.
4
What are the impacts of CVE-2023-25495?
The impact of CVE-2023-25495 is the potential exposure of LDAP client passwords, leading to unauthorized access to systems relying on LDAP for authentication.
5
Who is vulnerable to CVE-2023-25495?
Organizations using vulnerable Lenovo ThinkAgile firmware versions with LDAP configuration are exposed to CVE-2023-25495.