CVE-2023-25495: Lenovo Thinkagile HX1021 Firmware

Medium severity, CVSS 4.9. EPSS: 0.6% chance of exploitation in the next 30 days.

A valid, authenticated administrative user can query a web interface API to reveal the configured LDAP client password used by XCC to authenticate to an external LDAP server in certain configurations. There is no exposure where no LDAP client password is configured

Affected products

  • Lenovo Thinkagile HX1021 Firmware: before 3.72_tei388s (fixed in 3.72_tei388s)
  • Lenovo Thinkagile HX1320 Firmware: before 8.88_cdi3a4a (fixed in 8.88_cdi3a4a)
  • Lenovo Thinkagile HX1321 Firmware: before 8.88_cdi3a4a (fixed in 8.88_cdi3a4a)
  • Lenovo Thinkagile HX1331 Firmware: before 2.93_afbt30p (fixed in 2.93_afbt30p)
  • Lenovo Thinkagile HX1520-R Firmware: before 8.88_cdi3a4a (fixed in 8.88_cdi3a4a)
  • Lenovo Thinkagile HX1521-R Firmware: before 8.88_cdi3a4a (fixed in 8.88_cdi3a4a)
  • Lenovo Thinkagile HX2320-E Firmware: before 8.88_cdi3a4a (fixed in 8.88_cdi3a4a)
  • Lenovo Thinkagile HX2321 Firmware: before 8.88_cdi3a4a (fixed in 8.88_cdi3a4a)
  • Lenovo Thinkagile HX2330 Firmware: before 2.93_afbt30p (fixed in 2.93_afbt30p); version 2.93_afbt30p only
  • Lenovo Thinkagile HX2331 Firmware: before 2.93_afbt30p (fixed in 2.93_afbt30p)
  • Lenovo Thinkagile HX2720-E Firmware: before 3.72_tei388s (fixed in 3.72_tei388s)
  • Lenovo Thinkagile HX3320 Firmware: before 8.88_cdi3a4a (fixed in 8.88_cdi3a4a)
  • Lenovo Thinkagile HX3321 Firmware: before 8.88_cdi3a4a (fixed in 8.88_cdi3a4a)
  • Lenovo Thinkagile HX3330 Firmware: before 2.93_afbt30p (fixed in 2.93_afbt30p)
  • Lenovo Thinkagile HX3331 Firmware: before 2.93_afbt30p (fixed in 2.93_afbt30p); before 4.71_d8bt48p (fixed in 4.71_d8bt48p)
  • Lenovo Thinkagile HX3375 Firmware: before 4.71_d8bt48p (fixed in 4.71_d8bt48p)
  • Lenovo Thinkagile HX3376 Firmware: before 8.88_cdi3a4a (fixed in 8.88_cdi3a4a)
  • Lenovo Thinkagile HX3520-G Firmware: before 8.88_cdi3a4a (fixed in 8.88_cdi3a4a)
  • Lenovo Thinkagile HX3521-G Firmware: before 3.72_tei388s (fixed in 3.72_tei388s)
  • Lenovo Thinkagile HX3720 Firmware: before 3.72_tei388s (fixed in 3.72_tei388s)
  • Lenovo Thinkagile HX3721 Firmware: before 8.88_cdi3a4a (fixed in 8.88_cdi3a4a)
  • Lenovo Thinkagile HX5520-C Firmware: before 8.88_cdi3a4a (fixed in 8.88_cdi3a4a)
  • Lenovo Thinkagile HX5520 Firmware: before 8.88_cdi3a4a (fixed in 8.88_cdi3a4a)
  • Lenovo Thinkagile HX5521-C Firmware: before 2.93_afbt30p (fixed in 2.93_afbt30p)
  • Lenovo Thinkagile HX5521 Firmware: before 8.88_cdi3a4a (fixed in 8.88_cdi3a4a)
  • and 84 more

Published 2023-04-28. Last modified 2026-06-17.