Medium severity · published Apr 28, 2023
CVE-2023-29058
A valid, authenticated XCC user with read-only permissions can modify custom user roles on other user accounts and the user trespass message through the XCC CLI
6.5
CVSS
0.4%
EPSS
No
On KEV
Description
A valid, authenticated XCC user with read-only permissions can modify custom user roles on other user accounts and the user trespass message through the XCC CLI. There is no exposure if SSH is disabled or if there are no users assigned optional read-only permissions.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 30% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TH
Thinkagile HX Enclosure Firmware · Lenovo
before 3.72_tei388s · source: NVD
TH
Thinkagile Hx1021 Firmware · Lenovo
before 3.72_tei388s · source: NVD
TH
Thinkagile Hx1320 Firmware · Lenovo
before 8.88_cdi3a4a · source: NVD
TH
Thinkagile Hx1321 Firmware · Lenovo
before 8.88_cdi3a4a · source: NVD
TH
Thinkagile Hx1331 Firmware · Lenovo
before 2.93_afbt30p · source: NVD
TH
Thinkagile Hx1520-r Firmware · Lenovo
before 8.88_cdi3a4a · source: NVD
TH
Thinkagile Hx1521-r Firmware · Lenovo
before 8.88_cdi3a4a · source: NVD
TH
Thinkagile Hx2320-e Firmware · Lenovo
before 8.88_cdi3a4a · source: NVD
TH
Thinkagile Hx2321 Firmware · Lenovo
before 8.88_cdi3a4a · source: NVD
TH
Thinkagile Hx2330 Firmware · Lenovo
before 2.93_afbt30p; 2.93_afbt30p · source: NVD
TH
Thinkagile Hx2331 Firmware · Lenovo
before 2.93_afbt30p · source: NVD
TH
Thinkagile Hx2720-e Firmware · Lenovo
before 3.72_tei388s · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-29058
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-29058
Vendor Advisory
https://support.lenovo.com/us/en/product_security/LEN-118321
More from Thinkagile HX Enclosure Firmware
8.8
CVE-2023-4607
An authenticated XCC user can change permissions for any user through a crafted API command
8.8
CVE-2023-25492
A valid, authenticated user may be able to trigger a denial of service of the XCC web user interface or other undefined behavior through a format string injection vulnerability in…
8.8
CVE-2023-0683
A valid, authenticated XCC user with read only access may gain elevated privileges through a specifically crafted API call
8.8
CVE-2023-29057
A valid XCC user's local account permissions overrides their active directory permissions under specific configurations
7.2
CVE-2024-2659
A command injection vulnerability was identified in SMM/SMM2 and FPC that could allow an authenticated user with elevated privileges to execute system commands when performing a…