CVE-2023-4608: Lenovo Thinkagile HX1331 Firmware

High severity, CVSS 7.2. EPSS: 0.4% chance of exploitation in the next 30 days.

An authenticated XCC user with elevated privileges can perform blind SQL injection in limited cases through a crafted API command.  This affects ThinkSystem v2 and v3 servers with XCC; ThinkSystem v1 servers are not affected.

Affected products

  • Lenovo Thinkagile HX1331 Firmware: affected versions not specified
  • Lenovo Thinkagile HX2330 Firmware: affected versions not specified
  • Lenovo Thinkagile HX2331 Firmware: affected versions not specified
  • Lenovo Thinkagile HX3330 Firmware: affected versions not specified
  • Lenovo Thinkagile HX3331 Firmware: affected versions not specified
  • Lenovo Thinkagile HX3375 Firmware: affected versions not specified
  • Lenovo Thinkagile HX3376 Firmware: affected versions not specified
  • Lenovo Thinkagile HX5530 Firmware: affected versions not specified
  • Lenovo Thinkagile HX5531 Firmware: affected versions not specified
  • Lenovo Thinkagile HX7530 Firmware: affected versions not specified
  • Lenovo Thinkagile HX7531 Firmware: affected versions not specified
  • Lenovo Thinkagile MX3330-F All-Flash Firmware: affected versions not specified
  • Lenovo Thinkagile MX3330-H Hybrid Firmware: affected versions not specified
  • Lenovo Thinkagile MX3331-F All-Flash Firmware: affected versions not specified
  • Lenovo Thinkagile MX3331-H Hybrid Firmware: affected versions not specified
  • Lenovo Thinkagile MX3530-H Hybrid Firmware: affected versions not specified
  • Lenovo Thinkagile MX3530 F All Flash Firmware: affected versions not specified
  • Lenovo Thinkagile MX3531-F All-Flash Firmware: affected versions not specified
  • Lenovo Thinkagile MX3531 H Hybrid Firmware: affected versions not specified
  • Lenovo Thinkagile VX2330 Firmware: affected versions not specified
  • Lenovo Thinkagile VX3330 Firmware: affected versions not specified
  • Lenovo Thinkagile VX3331 Firmware: affected versions not specified
  • Lenovo Thinkagile VX3530-G Firmware: affected versions not specified
  • Lenovo Thinkagile VX5530 Firmware: affected versions not specified
  • Lenovo Thinkagile VX7330 Firmware: affected versions not specified
  • and 33 more

Published 2023-10-25. Last modified 2026-06-17.