CVE-2023-4606: Lenovo Thinkagile HX1331 Firmware

High severity, CVSS 8.1. EPSS: 0.5% chance of exploitation in the next 30 days.

An authenticated XCC user with Read-Only permission can change a different user’s password through a crafted API command.   This affects ThinkSystem v2 and v3 servers with XCC; ThinkSystem v1 servers are not affected.

Affected products

  • Lenovo Thinkagile HX1331 Firmware: affected versions not specified
  • Lenovo Thinkagile HX2330 Firmware: affected versions not specified
  • Lenovo Thinkagile HX2331 Firmware: affected versions not specified
  • Lenovo Thinkagile HX3330 Firmware: affected versions not specified
  • Lenovo Thinkagile HX3331 Firmware: affected versions not specified
  • Lenovo Thinkagile HX3375 Firmware: affected versions not specified
  • Lenovo Thinkagile HX3376 Firmware: affected versions not specified
  • Lenovo Thinkagile HX5530 Firmware: affected versions not specified
  • Lenovo Thinkagile HX5531 Firmware: affected versions not specified
  • Lenovo Thinkagile HX7530 Firmware: affected versions not specified
  • Lenovo Thinkagile HX7531 Firmware: affected versions not specified
  • Lenovo Thinkagile MX3330-F All-Flash Firmware: affected versions not specified
  • Lenovo Thinkagile MX3330-H Hybrid Firmware: affected versions not specified
  • Lenovo Thinkagile MX3331-F All-Flash Firmware: affected versions not specified
  • Lenovo Thinkagile MX3331-H Hybrid Firmware: affected versions not specified
  • Lenovo Thinkagile MX3530-H Hybrid Firmware: affected versions not specified
  • Lenovo Thinkagile MX3530 F All Flash Firmware: affected versions not specified
  • Lenovo Thinkagile MX3531-F All-Flash Firmware: affected versions not specified
  • Lenovo Thinkagile MX3531 H Hybrid Firmware: affected versions not specified
  • Lenovo Thinkagile VX2330 Firmware: affected versions not specified
  • Lenovo Thinkagile VX3330 Firmware: affected versions not specified
  • Lenovo Thinkagile VX3331 Firmware: affected versions not specified
  • Lenovo Thinkagile VX3530-G Firmware: affected versions not specified
  • Lenovo Thinkagile VX5530 Firmware: affected versions not specified
  • Lenovo Thinkagile VX7330 Firmware: affected versions not specified
  • and 33 more

Published 2023-10-25. Last modified 2026-06-17.