CVE-2023-29056: Lenovo Thinkagile HX1021 Firmware

Medium severity, CVSS 5.9. EPSS: 0.4% chance of exploitation in the next 30 days.

A valid LDAP user, under specific conditions, will default to read-only permissions when authenticating into XCC. To be vulnerable, XCC must be configured to use an LDAP server for Authentication/Authorization and have the login permission attribute not defined.

Affected products

  • Lenovo Thinkagile HX1021 Firmware: before 3.72_tei388s (fixed in 3.72_tei388s)
  • Lenovo Thinkagile HX1320 Firmware: before 8.88_cdi3a4a (fixed in 8.88_cdi3a4a)
  • Lenovo Thinkagile HX1321 Firmware: before 8.88_cdi3a4a (fixed in 8.88_cdi3a4a)
  • Lenovo Thinkagile HX1331 Firmware: before 2.93_afbt30p (fixed in 2.93_afbt30p)
  • Lenovo Thinkagile HX1520-R Firmware: before 8.88_cdi3a4a (fixed in 8.88_cdi3a4a)
  • Lenovo Thinkagile HX1521-R Firmware: before 8.88_cdi3a4a (fixed in 8.88_cdi3a4a)
  • Lenovo Thinkagile HX2320-E Firmware: before 8.88_cdi3a4a (fixed in 8.88_cdi3a4a)
  • Lenovo Thinkagile HX2321 Firmware: before 8.88_cdi3a4a (fixed in 8.88_cdi3a4a)
  • Lenovo Thinkagile HX2330 Firmware: before 2.93_afbt30p (fixed in 2.93_afbt30p); version 2.93_afbt30p only
  • Lenovo Thinkagile HX2331 Firmware: before 2.93_afbt30p (fixed in 2.93_afbt30p)
  • Lenovo Thinkagile HX2720-E Firmware: before 3.72_tei388s (fixed in 3.72_tei388s)
  • Lenovo Thinkagile HX3320 Firmware: before 8.88_cdi3a4a (fixed in 8.88_cdi3a4a)
  • Lenovo Thinkagile HX3321 Firmware: before 8.88_cdi3a4a (fixed in 8.88_cdi3a4a)
  • Lenovo Thinkagile HX3330 Firmware: before 2.93_afbt30p (fixed in 2.93_afbt30p)
  • Lenovo Thinkagile HX3331 Firmware: before 2.93_afbt30p (fixed in 2.93_afbt30p); before 4.71_d8bt48p (fixed in 4.71_d8bt48p)
  • Lenovo Thinkagile HX3375 Firmware: before 4.71_d8bt48p (fixed in 4.71_d8bt48p)
  • Lenovo Thinkagile HX3376 Firmware: before 8.88_cdi3a4a (fixed in 8.88_cdi3a4a)
  • Lenovo Thinkagile HX3520-G Firmware: before 8.88_cdi3a4a (fixed in 8.88_cdi3a4a)
  • Lenovo Thinkagile HX3521-G Firmware: before 3.72_tei388s (fixed in 3.72_tei388s)
  • Lenovo Thinkagile HX3720 Firmware: before 3.72_tei388s (fixed in 3.72_tei388s)
  • Lenovo Thinkagile HX3721 Firmware: before 8.88_cdi3a4a (fixed in 8.88_cdi3a4a)
  • Lenovo Thinkagile HX5520-C Firmware: before 8.88_cdi3a4a (fixed in 8.88_cdi3a4a)
  • Lenovo Thinkagile HX5520 Firmware: before 8.88_cdi3a4a (fixed in 8.88_cdi3a4a)
  • Lenovo Thinkagile HX5521-C Firmware: before 2.93_afbt30p (fixed in 2.93_afbt30p)
  • Lenovo Thinkagile HX5521 Firmware: before 8.88_cdi3a4a (fixed in 8.88_cdi3a4a)
  • and 84 more

Published 2023-04-28. Last modified 2026-06-17.