CVE-2023-4607: High severity lenovo thinkagile hx5530 firmware vulnerability
Published Oct 24, 2023
ยทUpdated
An authenticated XCC user can change permissions for any user through a crafted API command.
Affected Software
232 affected components
All of the following
Lenovo Thinkagile Hx5530 Firmware
Lenovo Thinkagile Hx5530
All of the following
Lenovo Thinkagile Hx7530 Firmware
Lenovo Thinkagile Hx7530
All of the following
Lenovo Thinkagile Vx3331 Firmware
Lenovo Thinkagile Vx3331
All of the following
Lenovo Thinkagile Hx1331 Firmware
Lenovo Thinkagile Hx1331
All of the following
Lenovo Thinkagile Hx2330 Firmware
Lenovo Thinkagile Hx2330
All of the following
Lenovo Thinkagile Hx2331 Firmware
Lenovo Thinkagile Hx2331
All of the following
Lenovo Thinkagile Hx3330 Firmware
Lenovo Thinkagile Hx3330
All of the following
Lenovo Thinkagile Hx3331 Firmware
Lenovo Thinkagile Hx3331
All of the following
Lenovo Thinkagile Hx3375 Firmware
Lenovo Thinkagile Hx3375
All of the following
Lenovo Thinkagile Hx3376 Firmware
Lenovo Thinkagile Hx3376
All of the following
Lenovo Thinkagile Hx5531 Firmware
Lenovo Thinkagile Hx5531
All of the following
Lenovo Thinkagile Hx7531 Firmware
Lenovo Thinkagile Hx7531
All of the following
Lenovo Thinkagile Mx3330-f All-flash Firmware
Lenovo Thinkagile Mx3330-f All-flash
All of the following
Lenovo Thinkagile Mx3330-h Hybrid Firmware
Lenovo Thinkagile Mx3330-h Hybrid
All of the following
Lenovo Thinkagile Mx3331-f All-flash Firmware
Lenovo Thinkagile Mx3331-f All-flash
All of the following
Lenovo Thinkagile Mx3331-h Hybrid Firmware
Lenovo Thinkagile Mx3331-h Hybrid
All of the following
Lenovo Thinkagile Mx3530 F All Flash Firmware
Lenovo Thinkagile Mx3530 F All Flash
All of the following
Lenovo Thinkagile Mx3530-h Hybrid Firmware
Lenovo Thinkagile Mx3530-h Hybrid
All of the following
Lenovo Thinkagile Mx3531 H Hybrid Firmware
Lenovo Thinkagile Mx3531 H Hybrid
All of the following
Lenovo Thinkagile Mx3531-f All-flash Firmware
Lenovo Thinkagile Mx3531-f All-flash
All of the following
Lenovo Thinkagile Vx2330 Firmware
Lenovo Thinkagile Vx2330
All of the following
Lenovo Thinkagile Vx3330 Firmware
Lenovo Thinkagile Vx3330
All of the following
Lenovo Thinkagile Vx3530-g Firmware
Lenovo Thinkagile Vx3530-g
All of the following
Lenovo Thinkagile Vx5530 Firmware
Lenovo Thinkagile Vx5530
All of the following
Lenovo Thinkagile Vx7330 Firmware
Lenovo Thinkagile Vx7330
All of the following
Lenovo Thinkagile Vx7530 Firmware
Lenovo Thinkagile Vx7530
All of the following
Lenovo Thinkagile Vx7531 Firmware
Lenovo Thinkagile Vx7531
All of the following
Lenovo Thinksystem Sd630 V2 Firmware
Lenovo Thinksystem Sd630 V2
All of the following
Lenovo Thinksystem Sd650 V2 Firmware
Lenovo Thinksystem Sd650 V2
Lenovo Thinksystem Sd650 V3 Firmware
All of the following
Lenovo Thinksystem Sd650-n V2 Firmware
Lenovo Thinksystem Sd650-n V2
Lenovo Thinksystem Sd665 V3 Firmware
All of the following
Lenovo Thinksystem Sn550 V2 Firmware
Lenovo Thinksystem Sn550 V2
All of the following
Lenovo Thinksystem Sr250 Firmware
Lenovo Thinksystem Sr250 V2
All of the following
Lenovo Thinksystem Sr258 V2 Firmware
Lenovo Thinksystem Sr258 V2
All of the following
Lenovo Thinksystem Sr630 V2 Firmware
Lenovo Thinksystem Sr630 V2
Lenovo Thinksystem Sr630 V3 Firmware
Lenovo Thinksystem Sr635 V3 Firmware
All of the following
Lenovo Thinksystem Sr645 Firmware
Lenovo Thinksystem Sr645
All of the following
Lenovo Thinksystem Sr645 V3 Firmware
Lenovo Thinksystem Sr645 V3
All of the following
Lenovo Thinksystem Sr650 V2 Firmware
Lenovo Thinksystem Sr650 V2
Lenovo Thinksystem Sr650 V3 Firmware
Lenovo Thinksystem Sr655 V3 Firmware
All of the following
Lenovo Thinksystem Sr665 Firmware
Lenovo Thinksystem Sr665
Lenovo Thinksystem Sr665 V3 Firmware
All of the following
Lenovo Thinksystem Sr670 Firmware
Lenovo Thinksystem Sr670
All of the following
Lenovo Thinksystem Sr670 V2 Firmware
Lenovo Thinksystem Sr670 V2
Lenovo Thinksystem Sr675 V3 Firmware
All of the following
Lenovo Thinksystem Sr850 V2 Firmware
Lenovo Thinksystem Sr850 V2
Lenovo Thinksystem Sr850 V3 Firmware
All of the following
Lenovo Thinksystem Sr860 V2 Firmware
Lenovo Thinksystem Sr860 V2
Lenovo Thinksystem Sr860 V3 Firmware
All of the following
Lenovo Thinksystem St250 V2 Firmware
Lenovo Thinksystem St250 V2
All of the following
Lenovo Thinksystem St258 V2 Firmware
Lenovo Thinksystem St258 V2
All of the following
Lenovo Thinksystem St650 V2 Firmware
Lenovo Thinksystem St650 V2
Lenovo Thinksystem St650 V3 Firmware
All of the following
Lenovo Thinksystem St658 V2 Firmware
Lenovo Thinksystem St658 V2
Lenovo Thinksystem St658 V3 Firmware
All of the following
Lenovo Thinkagile Hx Enclosure Firmware
Lenovo Thinkagile Hx Enclosure
All of the following
Lenovo Thinkagile Hx1021 Edg Firmware
Lenovo Thinkagile Hx1021 Edg
All of the following
Lenovo Thinkagile Hx1320 Firmware
Lenovo Thinkagile Hx1320
All of the following
Lenovo Thinkagile Hx1321 Firmware
Lenovo Thinkagile Hx1321
All of the following
Lenovo Thinkagile Hx1520-r Firmware
Lenovo Thinkagile Hx1520-r
All of the following
Lenovo Thinkagile Hx1521-r Firmware
Lenovo Thinkagile Hx1521-r
All of the following
Lenovo Thinkagile Hx2320-e Firmware
Lenovo Thinkagile Hx2320-e
All of the following
Lenovo Thinkagile Hx2321 Firmware
Lenovo Thinkagile Hx2321
All of the following
Lenovo Thinkagile Hx2720-e Firmware
Lenovo Thinkagile Hx2720-e
All of the following
Lenovo Thinkagile Hx3320 Firmware
Lenovo Thinkagile Hx3320
All of the following
Lenovo Thinkagile Hx3321 Firmware
Lenovo Thinkagile Hx3321
All of the following
Lenovo Thinkagile Hx3520-g Firmware
Lenovo Thinkagile Hx3520-g
All of the following
Lenovo Thinkagile Hx3521-g Firmware
Lenovo Thinkagile Hx3521-g
All of the following
Lenovo Thinkagile Hx3720 Firmware
Lenovo Thinkagile Hx3720
All of the following
Lenovo Thinkagile Hx3721 Firmware
Lenovo Thinkagile Hx3721
All of the following
Lenovo Thinkagile Hx5520 Firmware
Lenovo Thinkagile Hx5520
All of the following
Lenovo Thinkagile Hx5520-c Firmware
Lenovo Thinkagile Hx5520-c
All of the following
Lenovo Thinkagile Hx5521 Firmware
Lenovo Thinkagile Hx5521
All of the following
Lenovo Thinkagile Hx5521-c Firmware
Lenovo Thinkagile Hx5521-c
All of the following
Lenovo Thinkagile Hx7520 Firmware
Lenovo Thinkagile Hx7520
All of the following
Lenovo Thinkagile Hx7521 Firmware
Lenovo Thinkagile Hx7521
All of the following
Lenovo Thinkagile Hx7820 Firmware
Lenovo Thinkagile Hx7820
All of the following
Lenovo Thinkagile Hx7821 Firmware
Lenovo Thinkagile Hx7821
All of the following
Lenovo Thinkagile Mx Edge- Mx1020 Firmware
Lenovo Thinkagile Mx Edge- Mx1020
Lenovo Thinkagile Mx630 V3 Firmware
Lenovo Thinkagile Mx630 V3 Intergrated System Firmware
Lenovo Thinkagile Mx650 V3 Firmware
Lenovo Thinkagile Mx650 V3 Intergrated System Firmware
All of the following
Lenovo Thinkagile Mx1021 On Se350 Firmware
Lenovo Thinkagile Mx1021 On Se350
All of the following
Lenovo Thinkagile Vx 1se Firmware
Lenovo Thinkagile Vx 1se
All of the following
Lenovo Thinkagile Vx 2u4n Firmware
Lenovo Thinkagile Vx 2u4n
All of the following
Lenovo Thinkagile Vx 4u Firmware
Lenovo Thinkagile Vx 4u
All of the following
Lenovo Thinkagile Vx1320 Firmware
Lenovo Thinkagile Vx1320
All of the following
Lenovo Thinkagile Vx2320 Firmware
Lenovo Thinkagile Vx2320
All of the following
Lenovo Thinkagile Vx3320 Firmware
Lenovo Thinkagile Vx3320
All of the following
Lenovo Thinkagile Vx3520-g Firmware
Lenovo Thinkagile Vx3520-g
All of the following
Lenovo Thinkagile Vx3720 Firmware
Lenovo Thinkagile Vx3720
All of the following
Lenovo Thinkagile Vx5520 Firmware
Lenovo Thinkagile Vx5520
All of the following
Lenovo Thinkagile Vx7320 N Firmware
Lenovo Thinkagile Vx7320 N
All of the following
Lenovo Thinkagile Vx7520 Firmware
Lenovo Thinkagile Vx7520
All of the following
Lenovo Thinkagile Vx7520 N Firmware
Lenovo Thinkagile Vx7520 N
All of the following
Lenovo Thinkagile Vx7820 Firmware
Lenovo Thinkagile Vx7820
All of the following
Lenovo Thinkedge Se450 Firmware
Lenovo Thinkedge Se450
All of the following
Lenovo Thinksystem Sd530 Firmware
Lenovo Thinksystem Sd530
All of the following
Lenovo Thinksystem Sd650 Dwc Dual Node Tray Firmware
Lenovo Thinksystem Sd650 Dwc Dual Node Tray
All of the following
Lenovo Thinksystem Sd650 Dual Node Tray Firmware
Lenovo Thinksystem Sd650 Dual Node Tray
All of the following
Lenovo Thinksystem Se350 Firmware
Lenovo Thinksystem Se350
All of the following
Lenovo Thinksystem Sn550 Firmware
Lenovo Thinksystem Sn550
All of the following
Lenovo Thinksystem Sn850 Firmware
Lenovo Thinksystem Sn850
All of the following
Lenovo Thinksystem Sr150 Firmware
Lenovo Thinksystem Sr150
All of the following
Lenovo Thinksystem Sr158 Firmware
Lenovo Thinksystem Sr158
All of the following
Lenovo Thinksystem Sr250 Firmware
Lenovo Thinksystem Sr250
All of the following
Lenovo Thinksystem Sr258 Firmware
Lenovo Thinksystem Sr258
All of the following
Lenovo Thinksystem Sr530 Firmware
Lenovo Thinksystem Sr530
All of the following
Lenovo Thinksystem Sr550 Firmware
Lenovo Thinksystem Sr550
All of the following
Lenovo Thinksystem Sr570 Firmware
Lenovo Thinksystem Sr570
All of the following
Lenovo Thinksystem Sr590 Firmware
Lenovo Thinkserver Sr590
All of the following
Lenovo Thinksystem Sr630 Firmware
Lenovo Thinksystem Sr630
All of the following
Lenovo Thinksystem Sr650 Firmware
Lenovo Thinksystem Sr650
All of the following
Lenovo Thinksystem Sr850 Firmware
Lenovo Thinksystem Sr850
All of the following
Lenovo Thinksystem Sr850p Firmware
Lenovo Thinksystem Sr850p
All of the following
Lenovo Thinksystem Sr860 Firmware
Lenovo Thinksystem Sr860
All of the following
Lenovo Thinksystem Sr950 Firmware
Lenovo Thinksystem Sr950
All of the following
Lenovo Thinksystem St250 Firmware
Lenovo Thinksystem St250
All of the following
Lenovo Thinksystem St258 Firmware
Lenovo Thinksystem St258
All of the following
Lenovo Thinksystem St550 Firmware
Lenovo Thinksystem St550
Remediation
Information
Upgrade to the product version (or newer) indicated for your model in the advisory: https://support.lenovo.com/us/en/product_security/LEN-140960
Event History
Oct 24, 2023
CVE Published
via MITREยท08:25 PM
Data Sourced
via MITREยท08:25 PM
RemedyDescriptionSeverityWeakness
Oct 25, 2023
Data Sourced
via NVDยท06:17 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2023-4607?
CVE-2023-4607 is classified as a critical vulnerability due to its exploitation leading to unauthorized permission changes.
2
Who is affected by CVE-2023-4607?
CVE-2023-4607 affects authenticated users of Lenovo's ThinkAgile product line, particularly those with access to the XCC management console.
3
How do I fix CVE-2023-4607?
To mitigate CVE-2023-4607, update to the latest firmware version available from Lenovo that addresses this vulnerability.
4
What type of vulnerability is CVE-2023-4607?
CVE-2023-4607 is identified as an authenticated access control vulnerability that allows users to alter permissions unlawfully.
5
What can attackers do with CVE-2023-4607?
An attacker exploiting CVE-2023-4607 can gain the ability to change user permissions within the system, potentially leading to further security breaches.