CVE-2023-4606
First published: Tue Oct 24 2023(Updated: )
An authenticated XCC user with Read-Only permission can change a different user’s password through a crafted API command. This affects ThinkSystem v2 and v3 servers with XCC; ThinkSystem v1 servers are not affected.
Credit: psirt@lenovo.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| All of | ||
| lenovo thinkagile hx5530 firmware | ||
| lenovo thinkagile hx5530 | ||
| All of | ||
| lenovo thinkagile hx7530 firmware | ||
| lenovo thinkagile hx7530 | ||
| All of | ||
| lenovo thinkagile vx3331 firmware | ||
| lenovo thinkagile vx3331 | ||
| All of | ||
| lenovo thinkagile hx1331 firmware | ||
| lenovo thinkagile hx1331 | ||
| All of | ||
| lenovo thinkagile hx2330 firmware | ||
| lenovo thinkagile hx2330 | ||
| All of | ||
| lenovo thinkagile hx2331 firmware | ||
| lenovo thinkagile hx2331 | ||
| All of | ||
| lenovo thinkagile hx3330 firmware | ||
| lenovo thinkagile hx3330 | ||
| All of | ||
| lenovo thinkagile hx3331 firmware | ||
| lenovo thinkagile hx3331 | ||
| All of | ||
| lenovo thinkagile hx3375 firmware | ||
| Lenovo thinkagile hx3375 | ||
| All of | ||
| lenovo thinkagile hx3376 firmware | ||
| Lenovo thinkagile hx3376 | ||
| All of | ||
| lenovo thinkagile hx5531 firmware | ||
| lenovo thinkagile hx5531 | ||
| All of | ||
| lenovo thinkagile hx7531 firmware | ||
| lenovo thinkagile hx7531 | ||
| All of | ||
| Lenovo ThinkAgile MX Certified Node - All Flash Firmware | ||
| lenovo thinkagile mx3330-f all-flash | ||
| All of | ||
| lenovo thinkagile mx3330-h hybrid firmware | ||
| lenovo thinkagile mx3330-h hybrid | ||
| All of | ||
| Lenovo ThinkAgile MX Certified Node - All Flash Firmware | ||
| lenovo thinkagile mx3331-f all-flash | ||
| All of | ||
| lenovo thinkagile mx3331-h hybrid firmware | ||
| lenovo thinkagile mx3331-h hybrid | ||
| All of | ||
| Lenovo ThinkAgile MX Certified Node - All Flash Firmware | ||
| lenovo thinkagile mx3530 f all flash | ||
| All of | ||
| lenovo thinkagile mx3530-h hybrid firmware | ||
| lenovo thinkagile mx3530-h hybrid | ||
| All of | ||
| lenovo thinkagile mx3531 h hybrid firmware | ||
| lenovo thinkagile mx3531 h hybrid | ||
| All of | ||
| Lenovo ThinkAgile MX Certified Node - All Flash Firmware | ||
| lenovo thinkagile mx3531-f all-flash | ||
| All of | ||
| lenovo thinkagile vx2330 firmware | ||
| lenovo thinkagile vx2330 | ||
| All of | ||
| lenovo thinkagile vx3330 firmware | ||
| lenovo thinkagile vx3330 | ||
| All of | ||
| lenovo thinkagile vx3530-g firmware | ||
| lenovo thinkagile vx3530-g | ||
| All of | ||
| lenovo thinkagile vx5530 firmware | ||
| lenovo thinkagile vx5530 | ||
| All of | ||
| lenovo thinkagile vx7330 firmware | ||
| lenovo thinkagile vx7330 | ||
| All of | ||
| lenovo thinkagile vx7530 firmware | ||
| lenovo thinkagile vx7530 | ||
| All of | ||
| lenovo thinkagile vx7531 firmware | ||
| lenovo thinkagile vx7531 | ||
| All of | ||
| lenovo thinksystem sd630 v2 firmware | ||
| lenovo thinksystem sd630 v2 | ||
| All of | ||
| lenovo thinksystem sd650 v2 firmware | ||
| lenovo thinksystem sd650 v2 | ||
| lenovo thinksystem sd650 v3 firmware | ||
| All of | ||
| lenovo thinksystem sd650-n v2 firmware | ||
| lenovo thinksystem sd650-n v2 | ||
| lenovo thinksystem sd665 v3 firmware | ||
| All of | ||
| lenovo thinksystem sn550 v2 firmware | ||
| lenovo thinksystem sn550 v2 | ||
| All of | ||
| lenovo thinksystem sr250 firmware | ||
| lenovo thinksystem sr250 v2 | ||
| All of | ||
| lenovo thinksystem sr258 v2 firmware | ||
| lenovo thinksystem sr258 v2 | ||
| All of | ||
| lenovo thinksystem sr630 v2 firmware | ||
| lenovo thinksystem sr630 v2 | ||
| lenovo thinksystem sr630 v3 firmware | ||
| lenovo thinksystem sr635 v3 firmware | ||
| All of | ||
| lenovo thinksystem sr645 firmware | ||
| Lenovo thinksystem sr645 | ||
| All of | ||
| lenovo thinksystem sr645 v3 firmware | ||
| lenovo thinksystem sr645 v3 | ||
| All of | ||
| lenovo thinksystem sr650 v2 firmware | ||
| lenovo thinksystem sr650 v2 | ||
| lenovo thinksystem sr650 v3 firmware | ||
| lenovo thinksystem sr655 v3 firmware | ||
| All of | ||
| lenovo thinksystem sr665 firmware | ||
| Lenovo thinksystem sr665 | ||
| lenovo thinksystem sr665 v3 firmware | ||
| All of | ||
| lenovo thinksystem sr670 firmware | ||
| lenovo thinksystem sr670 | ||
| All of | ||
| lenovo thinksystem sr670 v2 firmware | ||
| lenovo thinksystem sr670 v2 | ||
| lenovo thinksystem sr675 v3 firmware | ||
| All of | ||
| lenovo thinksystem sr850 v2 firmware | ||
| lenovo thinksystem sr850 v2 | ||
| lenovo thinksystem sr850 v3 firmware | ||
| All of | ||
| lenovo thinksystem sr860 v2 firmware | ||
| lenovo thinksystem sr860 v2 | ||
| lenovo thinksystem sr860 v3 firmware | ||
| All of | ||
| lenovo thinksystem st250 v2 firmware | ||
| lenovo thinksystem st250 v2 | ||
| All of | ||
| lenovo thinksystem st258 v2 firmware | ||
| lenovo thinksystem st258 v2 | ||
| All of | ||
| lenovo thinksystem st650 v2 firmware | ||
| lenovo thinksystem st650 v2 | ||
| lenovo thinksystem st650 v3 firmware | ||
| All of | ||
| lenovo thinksystem st658 v2 firmware | ||
| lenovo thinksystem st658 v2 | ||
| lenovo thinksystem st658 v3 firmware |
Remedy
Upgrade to the product version (or newer) indicated for your model in the advisory: https://support.lenovo.com/us/en/product_security/LEN-140960
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- agent/type
- agent/remedy
- agent/weakness
- agent/author
- agent/severity
- agent/references
- agent/description
- agent/first-publish-date
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/event
- agent/softwarecombine
- agent/source
- agent/tags
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/lenovo
- canonical/lenovo thinkagile hx5530 firmware
- canonical/lenovo thinkagile hx5530
- canonical/lenovo thinkagile hx7530 firmware
- canonical/lenovo thinkagile hx7530
- canonical/lenovo thinkagile vx3331 firmware
- canonical/lenovo thinkagile vx3331
- canonical/lenovo thinkagile hx1331 firmware
- canonical/lenovo thinkagile hx1331
- canonical/lenovo thinkagile hx2330 firmware
- canonical/lenovo thinkagile hx2330
- canonical/lenovo thinkagile hx2331 firmware
- canonical/lenovo thinkagile hx2331
- canonical/lenovo thinkagile hx3330 firmware
- canonical/lenovo thinkagile hx3330
- canonical/lenovo thinkagile hx3331 firmware
- canonical/lenovo thinkagile hx3331
- canonical/lenovo thinkagile hx3375 firmware
- canonical/lenovo thinkagile hx3375
- canonical/lenovo thinkagile hx3376 firmware
- canonical/lenovo thinkagile hx3376
- canonical/lenovo thinkagile hx5531 firmware
- canonical/lenovo thinkagile hx5531
- canonical/lenovo thinkagile hx7531 firmware
- canonical/lenovo thinkagile hx7531
- canonical/lenovo thinkagile mx certified node - all flash firmware
- canonical/lenovo thinkagile mx3330-f all-flash
- canonical/lenovo thinkagile mx3330-h hybrid firmware
- canonical/lenovo thinkagile mx3330-h hybrid
- canonical/lenovo thinkagile mx3331-f all-flash
- canonical/lenovo thinkagile mx3331-h hybrid firmware
- canonical/lenovo thinkagile mx3331-h hybrid
- canonical/lenovo thinkagile mx3530 f all flash
- canonical/lenovo thinkagile mx3530-h hybrid firmware
- canonical/lenovo thinkagile mx3530-h hybrid
- canonical/lenovo thinkagile mx3531 h hybrid firmware
- canonical/lenovo thinkagile mx3531 h hybrid
- canonical/lenovo thinkagile mx3531-f all-flash
- canonical/lenovo thinkagile vx2330 firmware
- canonical/lenovo thinkagile vx2330
- canonical/lenovo thinkagile vx3330 firmware
- canonical/lenovo thinkagile vx3330
- canonical/lenovo thinkagile vx3530-g firmware
- canonical/lenovo thinkagile vx3530-g
- canonical/lenovo thinkagile vx5530 firmware
- canonical/lenovo thinkagile vx5530
- canonical/lenovo thinkagile vx7330 firmware
- canonical/lenovo thinkagile vx7330
- canonical/lenovo thinkagile vx7530 firmware
- canonical/lenovo thinkagile vx7530
- canonical/lenovo thinkagile vx7531 firmware
- canonical/lenovo thinkagile vx7531
- canonical/lenovo thinksystem sd630 v2 firmware
- canonical/lenovo thinksystem sd630 v2
- canonical/lenovo thinksystem sd650 v2 firmware
- canonical/lenovo thinksystem sd650 v2
- canonical/lenovo thinksystem sd650 v3 firmware
- canonical/lenovo thinksystem sd650-n v2 firmware
- canonical/lenovo thinksystem sd650-n v2
- canonical/lenovo thinksystem sd665 v3 firmware
- canonical/lenovo thinksystem sn550 v2 firmware
- canonical/lenovo thinksystem sn550 v2
- canonical/lenovo thinksystem sr250 firmware
- canonical/lenovo thinksystem sr250 v2
- canonical/lenovo thinksystem sr258 v2 firmware
- canonical/lenovo thinksystem sr258 v2
- canonical/lenovo thinksystem sr630 v2 firmware
- canonical/lenovo thinksystem sr630 v2
- canonical/lenovo thinksystem sr630 v3 firmware
- canonical/lenovo thinksystem sr635 v3 firmware
- canonical/lenovo thinksystem sr645 firmware
- canonical/lenovo thinksystem sr645
- canonical/lenovo thinksystem sr645 v3 firmware
- canonical/lenovo thinksystem sr645 v3
- canonical/lenovo thinksystem sr650 v2 firmware
- canonical/lenovo thinksystem sr650 v2
- canonical/lenovo thinksystem sr650 v3 firmware
- canonical/lenovo thinksystem sr655 v3 firmware
- canonical/lenovo thinksystem sr665 firmware
- canonical/lenovo thinksystem sr665
- canonical/lenovo thinksystem sr665 v3 firmware
- canonical/lenovo thinksystem sr670 firmware
- canonical/lenovo thinksystem sr670
- canonical/lenovo thinksystem sr670 v2 firmware
- canonical/lenovo thinksystem sr670 v2
- canonical/lenovo thinksystem sr675 v3 firmware
- canonical/lenovo thinksystem sr850 v2 firmware
- canonical/lenovo thinksystem sr850 v2
- canonical/lenovo thinksystem sr850 v3 firmware
- canonical/lenovo thinksystem sr860 v2 firmware
- canonical/lenovo thinksystem sr860 v2
- canonical/lenovo thinksystem sr860 v3 firmware
- canonical/lenovo thinksystem st250 v2 firmware
- canonical/lenovo thinksystem st250 v2
- canonical/lenovo thinksystem st258 v2 firmware
- canonical/lenovo thinksystem st258 v2
- canonical/lenovo thinksystem st650 v2 firmware
- canonical/lenovo thinksystem st650 v2
- canonical/lenovo thinksystem st650 v3 firmware
- canonical/lenovo thinksystem st658 v2 firmware
- canonical/lenovo thinksystem st658 v2
- canonical/lenovo thinksystem st658 v3 firmware