CVE-2024-38511Network attack vector

Privilege escalation via crafted file upload

Published Jul 26, 2024 · Updated Aug 2, 2024

Command injection in Lenovo XClarity Controller allows remote authenticated users with elevated privileges to escalate via a crafted file upload. The upload-processing path invokes an operating-system command with unneutralized upload data; Lenovo has not disclosed the affected function or field. Exploitation requires an elevated XCC account and executes commands with controller privileges, affecting data and controller operation.

CVSS severity7.2
High
EPSS probability1.01%
Next 30 days · Sep 16, 2026
Known exploitationUnconfirmed
Based on sourced intelligence
Hinoki checkNot available
Coverage for this vulnerability

See if you're affected

Explore vulnerability checks for your environment with Hinoki.

Book a demo

Summary

What happened

Command injection in Lenovo XClarity Controller allows remote authenticated users with elevated privileges to escalate via a crafted file upload. The upload-processing path invokes an operating-system command with unneutralized upload data; Lenovo has not disclosed the affected function or field. Exploitation requires an elevated XCC account and executes commands with controller privileges, affecting data and controller operation.

The record

CVE
CVE-2024-38511
Published
Jul 26, 2024
Updated
Aug 2, 2024
Vendor
Lenovo
Product
Lenovo ThinkAgile HX1521-R Firmware
Classifications
CWE-78, T1059
Attack vector
network
Privileges
admin

Timeline

How it unfolded

  1. Jul 26, 2024CVE publishedPublication date reported by the CVE source.
  2. Aug 2, 2024Record updatedLatest update available in the CVE record.

Exploitability

Present is not the same as exploitable

Compare your product and version with the public record. A matching version still requires validation against your environment.

Is a vulnerable build present?

Compare these published version ranges with your installed build and any vendor patches.

  1. Affected versionversion=0 <9.97

What conditions does exploitation require?

Attack vectornetwork
Required privilegesadmin

What is affected?

Lenovo · Lenovo ThinkAgile HX1521-R Firmwareversion=0 <9.97
Lenovo · Lenovo ThinkSystem SR158 Firmwareversion=0 <4.11
Lenovo · Lenovo ThinkAgile HX7531 Firmwareversion=0 <4.71
Lenovo · Lenovo ThinkSystem SN850 Firmwareversion=0 <4.11; version=0 <6.36
Lenovo · Lenovo ThinkSystem SR850 V3 Firmwareversion=0 <1.20
Lenovo · Lenovo ThinkAgile HX2320-E Firmwareversion=0 <9.97
Lenovo · Lenovo ThinkSystem SR655 V3 Firmwareversion=0 <2.81
Lenovo · Lenovo ThinkAgile VX7320-N Firmwareversion=0 <9.97
Lenovo · Lenovo ThinkSystem SR250 Firmwareversion=0 <4.11
Lenovo · Lenovo ThinkSystem SR860 V3 Firmwareversion=0 <1.20
Lenovo · Lenovo ThinkAgile VX3720 Firmwareversion=0 <4.11
Lenovo · Lenovo ThinkAgile HX5530 Firmwareversion=0 <4.71
Lenovo · Lenovo ThinkAgile VX7531 Firmwareversion=0 <4.71
Lenovo · Lenovo ThinkSystem SR860 V2 Firmwareversion=0 <4.11
Lenovo · Lenovo ThinkAgile HX2321 Firmwareversion=0 <9.97
Lenovo · Lenovo ThinkAgile MX1020 Firmwareversion=0 <4.11
Lenovo · Lenovo ThinkSystem SR645 V3 Firmwareversion=0 <2.81
Lenovo · Lenovo ThinkSystem SR665 Firmwareversion=0 <5.61
Lenovo · Lenovo ThinkSystem ST650 V2 Firmwareversion=0 <4.11
Lenovo · Lenovo ThinkAgile HX3520-G Firmwareversion=0 <9.97
Lenovo · Lenovo ThinkAgile VX5520 Firmwareversion=0 <9.97
Lenovo · Lenovo ThinkAgile VX7520 Firmwareversion=0 <9.97
Lenovo · Lenovo ThinkAgile VX1320 Firmwareversion=0 <4.11
Lenovo · Lenovo ThinkSystem SR675 V3 Firmwareversion=0 <5.11
Lenovo · Lenovo ThinkSystem ST550 Firmwareversion=0 <9.97
Lenovo · Lenovo ThinkAgile VX5530 Firmwareversion=0 <4.71
Lenovo · Lenovo ThinkSystem SD665 V3 Firmwareversion=0 <5.11
Lenovo · Lenovo ThinkAgile MX3330-H Firmwareversion=0 <4.71
Lenovo · Lenovo ThinkAgile VX2320 Firmwareversion=0 <9.97
Lenovo · Lenovo ThinkSystem ST650 V3 Firmwareversion=0 <4.11
Lenovo · Lenovo ThinkAgile HX5531 Firmwareversion=0 <4.71
Lenovo · Lenovo ThinkAgile HX7821 Firmwareversion=0 <3.11
Lenovo · Lenovo ThinkAgile HX3376 Firmwareversion=0 <5.61
Lenovo · Lenovo ThinkAgile HX1321 Firmwareversion=0 <9.97
Lenovo · Lenovo ThinkSystem SR630 Firmwareversion=0 <9.97
Lenovo · Lenovo ThinkAgile HX2331 Firmwareversion=0 <4.71
Lenovo · Lenovo ThinkAgile HX7520 Firmwareversion=0 <9.97
Lenovo · Lenovo ThinkAgile VX3331 Firmwareversion=0 <4.71
Lenovo · Lenovo ThinkSystem ST658 V3 Firmwareversion=0 <4.11
Lenovo · Lenovo ThinkAgile VX3330 Firmwareversion=0 <4.71
Lenovo · Lenovo ThinkAgile MX3530-H Firmwareversion=0 <4.71
Lenovo · Lenovo ThinkAgile VX2330 Firmwareversion=0 <4.71
Lenovo · Lenovo ThinkAgile HX5521-C Firmwareversion=0 <9.97
Lenovo · Lenovo ThinkSystem SE350 Firmwareversion=0 <4.11
Lenovo · Lenovo ThinkAgile HX1320 Firmwareversion=0 <9.97
Lenovo · Lenovo ThinkAgile HX7820 Firmwareversion=0 <3.11
Lenovo · Lenovo ThinkAgile VX7520-N Firmwareversion=0 <9.97
Lenovo · Lenovo ThinkSystem SR645 Firmwareversion=0 <5.61
Lenovo · Lenovo ThinkSystem SR258 V2 Firmwareversion=0 <4.11
Lenovo · Lenovo ThinkSystem ST258 Firmwareversion=0 <4.11
Lenovo · Lenovo ThinkSystem SR635 Firmwareversion=0 <2.81
Lenovo · Lenovo ThinkStation P920 Workstation Firmwareversion=0 <9.97
Lenovo · Lenovo ThinkSystem SR630 V3 Firmwareversion=0 <4.51
Lenovo · Lenovo ThinkSystem SR860 Firmwareversion=0 <4.11
Lenovo · Lenovo ThinkSystem SD630 V2 Firmwareversion=0 <4.11
Lenovo · Lenovo ThinkSystem SN550 V2 Firmwareversion=0 <4.11
Lenovo · Lenovo ThinkAgile HX3521-G Firmwareversion=0 <9.97
Lenovo · Lenovo ThinkAgile VX3320 Firmwareversion=0 <9.97
Lenovo · Lenovo ThinkSystem SR590 Firmwareversion=0 <9.97
Lenovo · Lenovo ThinkSystem SR850 V2 Firmwareversion=0 <4.11
Lenovo · Lenovo ThinkSystem SR630 V2 Firmwareversion=0 <4.71
Lenovo · Lenovo ThinkAgile HX3721 Firmwareversion=0 <4.11
Lenovo · Lenovo ThinkSystem SR258 Firmwareversion=0 <4.11
Lenovo · Lenovo ThinkAgile MX3331-F Firmwareversion=0 <4.71
Lenovo · Lenovo ThinkSystem ST258 V2 Firmwareversion=0 <4.11
Lenovo · Lenovo ThinkAgile MX3330-F Firmwareversion=0 <4.71
Lenovo · Lenovo ThinkAgile HX7521 Firmwareversion=0 <9.97
Lenovo · Lenovo ThinkAgile HX3320 Firmwareversion=0 <9.97
Lenovo · Lenovo ThinkSystem SR850 Firmwareversion=0 <4.11; version=0 <6.36
Lenovo · Lenovo ThinkSystem SR850P Firmwareversion=0 <6.36
Lenovo · Lenovo ThinkSystem SR530 Firmwareversion=0 <9.97
Lenovo · Lenovo ThinkSystem SR650 V2 Firmwareversion=0 <4.71
Lenovo · Lenovo ThinkAgile HX3720 Firmwareversion=0 <4.11
Lenovo · Lenovo ThinkSystem SR650 Firmwareversion=0 <9.97
Lenovo · Lenovo ThinkAgile VX7530 Firmwareversion=0 <4.71
Lenovo · Lenovo ThinkSystem SR670 Firmwareversion=0 <4.11
Lenovo · Lenovo ThinkAgile HX3321 Firmwareversion=0 <9.97
Lenovo · Lenovo ThinkAgile VX3530-G Firmwareversion=0 <4.71
Lenovo · Lenovo ThinkAgile HX3331 Certified Nodeversion=0 <4.71
Lenovo · Lenovo ThinkSystem SR665 V3 Firmwareversion=0 <2.81; version=0 <5.61
Lenovo · Lenovo ThinkAgile HX3330 Firmwareversion=0 <4.71
Lenovo · Lenovo ThinkSystem SD530 Firmwareversion=0 <4.11
Lenovo · Lenovo ThinkAgile MX3331-H Firmwareversion=0 <4.71
Lenovo · Lenovo ThinkSystem SR570 Firmwareversion=0 <9.97
Lenovo · Lenovo ThinkSystem SR150 Firmwareversion=0 <4.11
Lenovo · Lenovo ThinkAgile HX2330 Firmwareversion=0 <4.71
Lenovo · Lenovo ThinkSystem SD650-N V2 Firmwareversion=0 <4.11
Lenovo · Lenovo ThinkAgile MX3530-F Firmwareversion=0 <4.71
Lenovo · Lenovo ThinkSystem SN550 Firmwareversion=0 <4.11; version=0 <6.36
Lenovo · Lenovo ThinkSystem ST250 V2 Firmwareversion=0 <4.11
Lenovo · Lenovo ThinkSystem SR250 V2 Firmwareversion=0 <4.11
Lenovo · Lenovo ThinkAgile HX7530 Firmwareversion=0 <4.71
Lenovo · Lenovo ThinkAgile VX7330 Firmwareversion=0 <4.71
Lenovo · Lenovo ThinkSystem SD650 Dual Node Tray Firmwareversion=0 <4.11; version=0 <6.36
Lenovo · Lenovo ThinkAgile HX2720-E Firmwareversion=0 <4.11
Lenovo · Lenovo ThinkSystem SD650 V3 Firmwareversion=0 <4.11
Lenovo · Lenovo ThinkSystem SR670 V2 Firmwareversion=0 <4.11; version=0 <5.11
Lenovo · Lenovo ThinkAgile VX7820 Firmwareversion=0 <3.11
Lenovo · Lenovo ThinkAgile HX1021 Edge Certified Node Firmwareversion=0 <4.11
Lenovo · Lenovo ThinkAgile HX5520-C Firmwareversion=0 <9.97
Lenovo · Lenovo ThinkAgile HX3375 Firmwareversion=0 <5.61
Lenovo · Lenovo ThinkSystem SR950 Firmwareversion=0 <3.11
Lenovo · Lenovo XClarity Controllerversion=various
Lenovo · Lenovo ThinkSystem SR550 Firmwareversion=0 <9.97
Lenovo · Lenovo ThinkAgile HX1520-R Firmwareversion=0 <9.97
Lenovo · Lenovo ThinkSystem ST250 Firmwareversion=0 <1.12; version=0 <4.11
Lenovo · Lenovo ThinkAgile HX1331 Firmwareversion=0 <4.71
Lenovo · Lenovo ThinkAgile MX3531-F Firmwareversion=0 <4.71
Lenovo · Lenovo ThinkAgile HX Enclosure Certified Node Firmwareversion=0 <4.11
Lenovo · Lenovo ThinkAgile VX3520-G Firmwareversion=0 <9.97

Published CVSS scores

7.2Lenovo Group Ltd.CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CVSS describes severity. EPSS estimates exploitation probability.

Attacks

What attackers are doing with it

Daily unique IPs observed by Shadowserver honeypots for known exploited vulnerabilities (KEVs). Missing observations do not establish an absence of attacks.

Daily unique IPsNo honeypot observations are available for this CVE in the selected window.

No observations available

Sep 10, 2026Sep 16, 2026
Latest reporting daySep 16, 2026
Latest daily unique IPsUnavailable
Prior 30-day averageUnavailable
SourceShadowserver honeypots (KEV)
Vectornetwork
Privilegesadmin
Known exploitationUnconfirmed
Public exploitUnconfirmed

Weakness, pattern, technique

CWE-78Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
T1059Command and Scripting Interpreter

Public exploit references

No public exploit references are available in this record.

Labels summarize the accepted research assessment. They do not indicate a test against your environment.

Technologies

Your stack

See the directory against your own environment.

Your stack

Check the software in your environment

Book a demo to see how Hinoki identifies affected software and validates exploitability in your environment.

Book a demo