Permissions, Privileges, and Access Controls in Lenovo products - CVE-2023-4606

Vulnerability identifier: #VU80745

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-4606

CWE-ID: CWE-264

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote user to escalate privileges on the system.

The vulnerability exists due to improperly imposed security restrictions. A remote authenticated Lenovo XClarity Controller (XCC) user with ReadOnly permissions can use an API command to change password of another user.

ThinkSystem SR675 V3
ThinkSystem SR860 V3
ThinkSystem SR850 V3
ThinkSystem SD665 V3
ThinkSystem SR635 V3
ThinkSystem SR645 V3
ThinkSystem SR655 V3
ThinkSystem SR665 V3
ThinkSystem SD650 V3
ThinkSystem SR630 V3
ThinkSystem SR650 V3
ThinkSystem ST658 V3
ThinkSystem ST650 V3
ThinkSystem SR630 V2
ThinkAgile HX5530 Appliance
ThinkSystem SD650 V2
ThinkSystem SD630 V2
ThinkSystem SD650-N V2
ThinkSystem ST658 V2
ThinkSystem SN550 V2
ThinkSystem SR250 V2
ThinkSystem SR258 V2
ThinkSystem SR670 V2
ThinkSystem ST650 V2
ThinkSystem ST258 V2
ThinkSystem SR650 V2
ThinkSystem ST250 V2
ThinkSystem SR860 V2
ThinkSystem SR850 V2
ThinkAgile MX3330-F All-flash Appliance
ThinkAgile HX7530 Appliance
ThinkAgile VX3331 Certified Node
ThinkAgile HX1331 Certified Node
ThinkAgile HX2330 Appliance
ThinkAgile HX2331 Certified Node
ThinkAgile HX3330 Appliance
ThinkAgile HX3331 Certified Node
ThinkAgile HX3331 Node SAP HANA
ThinkAgile HX5531 Certified Node
ThinkAgile HX7530 Appl for SAP HANA
ThinkAgile HX7531 Certified Node
ThinkAgile HX7531 Node SAP HANA
ThinkAgile VX7531 Certified Node
ThinkAgile MX3331-F All-flash Certified node
ThinkAgile VX7530 Appliance
Thinkagile VX7330 Appliance
ThinkAgile VX5530 Appliance
ThinkAgile VX3530-G Appliance
ThinkAgile VX3330 Appliance
ThinkAgile VX2330 Appliance
ThinkAgile MX3531-F All-flash Certified node
ThinkAgile MX3531 H Hybrid Certified node
ThinkAgile MX3530-H Hybrid Appliance
ThinkAgile MX3530 F All flash Appliance
ThinkAgile MX3331-H Hybrid Certified node
ThinkAgile MX3330-H Hybrid Appliance
ThinkAgile HX3375 Appliance
ThinkAgile HX3376 Certified Node
ThinkSystem SR665
ThinkSystem SR645

Install updates from vendor's website.

ThinkSystem SR675 V3 - update to 1.11 QGX318C
ThinkSystem SR860 V3 - update to 1.11 RSX306C
ThinkSystem SR850 V3 - update to 1.11 RSX306C
ThinkSystem SD665 V3 - update to 2.12 KAX318V
ThinkSystem SR635 V3 - update to 2.12 KAX318V
ThinkSystem SR645 V3 - update to 2.12 KAX318V
ThinkSystem SR655 V3 - update to 2.12 KAX318V
ThinkSystem SR665 V3 - update to 2.12 KAX318V
ThinkSystem SD650 V3 - update to 2.12 USX320Y
ThinkSystem SR630 V3 - update to 2.14 ESE114R
ThinkSystem SR650 V3 - update to 2.14 ESE114R
ThinkSystem ST658 V3 - update to 2.17 USX330E
ThinkSystem ST650 V3 - update to 2.17 USX330E
ThinkSystem SR630 V2 - update to 2.85 TGBT44N
ThinkAgile HX5530 Appliance - update to 2.85 TGBT44N
ThinkSystem SD650 V2 - update to 2.85 TGBT44N
ThinkSystem SD630 V2 - update to 2.85 TGBT44N
ThinkSystem SD650-N V2 - update to 2.85 TGBT44N
ThinkSystem ST658 V2 - update to 2.85 TGBT44N
ThinkSystem SN550 V2 - update to 2.85 TGBT44N
ThinkSystem SR250 V2 - update to 2.85 TGBT44N
ThinkSystem SR258 V2 - update to 2.85 TGBT44N
ThinkSystem SR670 V2 - update to 2.85 TGBT44N
ThinkSystem ST650 V2 - update to 2.85 TGBT44N
ThinkSystem ST258 V2 - update to 2.85 TGBT44N
ThinkSystem SR650 V2 - update to 2.85 TGBT44N
ThinkSystem ST250 V2 - update to 2.85 TGBT44N
ThinkSystem SR860 V2 - update to 2.85 TGBT44N
ThinkSystem SR850 V2 - update to 2.85 TGBT44N
ThinkAgile MX3330-F All-flash Appliance - update to 2.85 TGBT44N
ThinkAgile HX7530 Appliance - update to 2.85 TGBT44N
ThinkAgile VX3331 Certified Node - update to 2.85 TGBT44N
ThinkAgile HX1331 Certified Node - update to 2.85 TGBT44N
ThinkAgile HX2330 Appliance - update to 2.85 TGBT44N
ThinkAgile HX2331 Certified Node - update to 2.85 TGBT44N
ThinkAgile HX3330 Appliance - update to 2.85 TGBT44N
ThinkAgile HX3331 Certified Node - update to 2.85 TGBT44N
ThinkAgile HX3331 Node SAP HANA - update to 2.85 TGBT44N
ThinkAgile HX5531 Certified Node - update to 2.85 TGBT44N
ThinkAgile HX7530 Appl for SAP HANA - update to 2.85 TGBT44N
ThinkAgile HX7531 Certified Node - update to 2.85 TGBT44N
ThinkAgile HX7531 Node SAP HANA - update to 2.85 TGBT44N
ThinkAgile VX7531 Certified Node - update to 2.85 TGBT44N
ThinkAgile MX3331-F All-flash Certified node - update to 2.85 TGBT44N
ThinkAgile VX7530 Appliance - update to 2.85 TGBT44N
Thinkagile VX7330 Appliance - update to 2.85 TGBT44N
ThinkAgile VX5530 Appliance - update to 2.85 TGBT44N
ThinkAgile VX3530-G Appliance - update to 2.85 TGBT44N
ThinkAgile VX3330 Appliance - update to 2.85 TGBT44N
ThinkAgile VX2330 Appliance - update to 2.85 TGBT44N
ThinkAgile MX3531-F All-flash Certified node - update to 2.85 TGBT44N
ThinkAgile MX3531 H Hybrid Certified node - update to 2.85 TGBT44N
ThinkAgile MX3530-H Hybrid Appliance - update to 2.85 TGBT44N
ThinkAgile MX3530 F All flash Appliance - update to 2.85 TGBT44N
ThinkAgile MX3331-H Hybrid Certified node - update to 2.85 TGBT44N
ThinkAgile MX3330-H Hybrid Appliance - update to 2.85 TGBT44N
ThinkAgile HX3375 Appliance - update to 5.00 D8BT54M
ThinkAgile HX3376 Certified Node - update to 5.00 D8BT54M
ThinkSystem SR665 - update to 5.00 D8BT54M
ThinkSystem SR645 - update to 5.00 D8BT54M

• https://support.lenovo.com/us/en/product_security/LEN-140960

• Multiple vulnerabilities in Lenovo XClarity Controller (XCC)