CVE-2023-0683: Lenovo Thinkagile HX1021 Firmware

High severity, CVSS 8.8. EPSS: 0.6% chance of exploitation in the next 30 days.

A valid, authenticated XCC user with read only access may gain elevated privileges through a specifically crafted API call.

Affected products

  • Lenovo Thinkagile HX1021 Firmware: before 3.72_tei388s (fixed in 3.72_tei388s)
  • Lenovo Thinkagile HX1320 Firmware: before 8.88_cdi3a4a (fixed in 8.88_cdi3a4a)
  • Lenovo Thinkagile HX1321 Firmware: before 8.88_cdi3a4a (fixed in 8.88_cdi3a4a)
  • Lenovo Thinkagile HX1331 Firmware: before 2.93_afbt30p (fixed in 2.93_afbt30p)
  • Lenovo Thinkagile HX1520-R Firmware: before 8.88_cdi3a4a (fixed in 8.88_cdi3a4a)
  • Lenovo Thinkagile HX1521-R Firmware: before 8.88_cdi3a4a (fixed in 8.88_cdi3a4a)
  • Lenovo Thinkagile HX2320-E Firmware: before 8.88_cdi3a4a (fixed in 8.88_cdi3a4a)
  • Lenovo Thinkagile HX2321 Firmware: before 8.88_cdi3a4a (fixed in 8.88_cdi3a4a)
  • Lenovo Thinkagile HX2330 Firmware: before 2.93_afbt30p (fixed in 2.93_afbt30p); version 2.93_afbt30p only
  • Lenovo Thinkagile HX2331 Firmware: before 2.93_afbt30p (fixed in 2.93_afbt30p)
  • Lenovo Thinkagile HX2720-E Firmware: before 3.72_tei388s (fixed in 3.72_tei388s)
  • Lenovo Thinkagile HX3320 Firmware: before 8.88_cdi3a4a (fixed in 8.88_cdi3a4a)
  • Lenovo Thinkagile HX3321 Firmware: before 8.88_cdi3a4a (fixed in 8.88_cdi3a4a)
  • Lenovo Thinkagile HX3330 Firmware: before 2.93_afbt30p (fixed in 2.93_afbt30p)
  • Lenovo Thinkagile HX3331 Firmware: before 2.93_afbt30p (fixed in 2.93_afbt30p); before 4.71_d8bt48p (fixed in 4.71_d8bt48p)
  • Lenovo Thinkagile HX3375 Firmware: before 4.71_d8bt48p (fixed in 4.71_d8bt48p)
  • Lenovo Thinkagile HX3376 Firmware: before 8.88_cdi3a4a (fixed in 8.88_cdi3a4a)
  • Lenovo Thinkagile HX3520-G Firmware: before 8.88_cdi3a4a (fixed in 8.88_cdi3a4a)
  • Lenovo Thinkagile HX3521-G Firmware: before 3.72_tei388s (fixed in 3.72_tei388s)
  • Lenovo Thinkagile HX3720 Firmware: before 3.72_tei388s (fixed in 3.72_tei388s)
  • Lenovo Thinkagile HX3721 Firmware: before 8.88_cdi3a4a (fixed in 8.88_cdi3a4a)
  • Lenovo Thinkagile HX5520-C Firmware: before 8.88_cdi3a4a (fixed in 8.88_cdi3a4a)
  • Lenovo Thinkagile HX5520 Firmware: before 8.88_cdi3a4a (fixed in 8.88_cdi3a4a)
  • Lenovo Thinkagile HX5521-C Firmware: before 2.93_afbt30p (fixed in 2.93_afbt30p)
  • Lenovo Thinkagile HX5521 Firmware: before 8.88_cdi3a4a (fixed in 8.88_cdi3a4a)
  • and 84 more

Published 2023-05-01. Last modified 2026-06-17.