Thinkagile Mx3330-f All-flash Firmware vulnerabilities

Product

Thinkagile Mx3330-f All-flash Firmware

by Lenovo · last CVE Oct 25, 2023

CVEs

On KEV

8.8

Max CVSS

New 30D

Severity mix

Critical 0High 3Medium 0Low 0

Severity

Exploitation

Watch

Add Thinkagile Mx3330-f All-flash Firmware to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2023-4607	8.8	1%	Oct 25	An authenticated XCC user can change permissions for any user through a crafted API command Affected: All versions, or not specified
CVE-2023-4606	8.1	1%	Oct 25	An authenticated XCC user with Read-Only permission can change a different user’s password through a crafted API command. This affects ThinkSystem v2 and v3 servers with XCC;… Affected: All versions, or not specified
CVE-2023-4608	7.2	0%	Oct 25	An authenticated XCC user with elevated privileges can perform blind SQL injection in limited cases through a crafted API command. This affects ThinkSystem v2 and v3 servers… Affected: All versions, or not specified