A privilege escalation vulnerability was discovered in the web interface or SSH captive command shell…

CVE-2024-38508 is an OS command injection flaw in Lenovo XClarity Controller (XCC/XCC2), the baseboard management controller embedded in Lenovo ThinkSystem servers (MX3330, SD650-V3, SN550, SR630, and many others). The vulnerable code lives in libvmtrans.so, specifically the mount_remote_folder routine used by the remote-media transport. It builds a /bin/mount command as a formatted string and passes it to a shell running under the root-privileged xferd daemon. The SMB domain and mount-option parameters are filtered against only 9 characters (space, quotes, apostrophe, slash, exclamation mark), allowing shell metacharacters like ;, $(), backticks, |, and & to pass through unescaped. Exploitation requires an authenticated XCC user with at least Operator/Remote-Media privilege level. Affected firmware includes XCC2 versions prior to v8.80; IBM lists fixed XCC versions as 6.20 for SN550 and 9.97 for SR630.

Lenovo's HIGH / 7.2 rating is defensible but slightly generous for real-world conditions. The CVSS vector correctly reflects PR:H (high privileges required), but the score does not account for the operational reality that BMC interfaces should live on isolated out-of-band management networks, drastically limiting the reachable attacker population. IBM scored a related assessment at 8.8 using PR:L, which overstates the privilege floor. The truth sits between: the vuln is serious because BMC root is hardware-level persistent access, but the prerequisite of already holding elevated BMC credentials means you are escalating from an already-compromised position, not breaking in from scratch. No in-the-wild exploitation and an EPSS of ~1% reinforce that this is a real but non-urgent threat.

1. Isolate BMC interfaces on dedicated management VLANs with strict ACLs — XCC management interfaces must not be reachable from production networks, user workstations, or the internet. Enforce network segmentation with ACLs allowing only authorized jump-box hosts. This is the single most effective control and should be verified within the noisgate mitigation SLA of 30 days for HIGH severity.
2. Audit and rotate XCC credentials fleet-wide — Enumerate all XCC accounts with Operator or Administrator roles. Rotate passwords to unique per-host values using provisioning automation (e.g., Lenovo XClarity Administrator, Ansible IPMI modules). Disable unused accounts. Shared BMC passwords dramatically increase blast radius.
3. Disable remote-media mount if not operationally required — If your operational workflows do not require XCC remote-media functionality, disable it in XCC configuration to eliminate the attack surface entirely. This removes the vulnerable code path from the reachable API surface.
4. Apply firmware update to fixed XCC version — Update XCC firmware to the fixed version for your hardware model (XCC2 v8.80+, or per-model versions from LEN-156781). Deploy within the noisgate remediation SLA of 180 days for HIGH severity. Use Lenovo XClarity Administrator or UpdateXpress for fleet-wide firmware deployment.
5. Enable XCC audit logging and forward to SIEM — Configure XCC to send audit logs via syslog or SNMP traps to your SIEM. Create detection rules for anomalous remote-media mount operations and unexpected login patterns to BMC interfaces.

Run this script from an auditor workstation that has network access to the target XCC management interface. Requires curl and network connectivity to the BMC on port 443. Usage: bash check_xcc_cve2024_38508.sh <XCC_IP> <USERNAME> <PASSWORD>. No elevated privileges needed on the auditor host.

#!/usr/bin/env bash
# check_xcc_cve2024_38508.sh
# Checks Lenovo XCC firmware version against CVE-2024-38508 fixed versions
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -euo pipefail

if [ $# -lt 3 ]; then
  echo "Usage: $0 <XCC_IP> <USERNAME> <PASSWORD>"
  echo "Example: $0 192.168.70.10 USERID PASSW0RD"
  exit 2
fi

XCC_IP="$1"
USERNAME="$2"
PASSWORD="$3"

echo "[*] Querying XCC firmware version at ${XCC_IP}..."

RESPONSE=$(curl -sk -u "${USERNAME}:${PASSWORD}" \
  "https://${XCC_IP}/redfish/v1/UpdateService/FirmwareInventory/BMC-Primary" \
  --connect-timeout 10 --max-time 30 2>/dev/null) || {
  echo "[!] Failed to connect to XCC at ${XCC_IP}"
  echo "UNKNOWN"
  exit 2
}

FW_VERSION=$(echo "${RESPONSE}" | grep -oP '"Version"\s*:\s*"\K[^"]+' 2>/dev/null) || true

if [ -z "${FW_VERSION}" ]; then
  # Try alternative Redfish path
  RESPONSE=$(curl -sk -u "${USERNAME}:${PASSWORD}" \
    "https://${XCC_IP}/redfish/v1/Managers/1" \
    --connect-timeout 10 --max-time 30 2>/dev/null) || true
  FW_VERSION=$(echo "${RESPONSE}" | grep -oP '"FirmwareVersion"\s*:\s*"\K[^"]+' 2>/dev/null) || true
fi

if [ -z "${FW_VERSION}" ]; then
  echo "[!] Could not determine XCC firmware version"
  echo "UNKNOWN"
  exit 2
fi

echo "[*] Detected XCC firmware version: ${FW_VERSION}"

# Extract major.minor version numbers for comparison
# XCC2 versions are like 8.80, vulnerable below that
# XCC versions vary by model
MAJOR=$(echo "${FW_VERSION}" | grep -oP '^[0-9]+' 2>/dev/null) || MAJOR=0
MINOR=$(echo "${FW_VERSION}" | grep -oP '\.[0-9]+' | head -1 | tr -d '.' 2>/dev/null) || MINOR=0

echo "[*] Parsed version: major=${MAJOR}, minor=${MINOR}"

# XCC2 fixed at v8.80+
if [ "${MAJOR}" -gt 8 ] 2>/dev/null; then
  echo "[+] Firmware version ${FW_VERSION} is above known fixed version (8.80)"
  echo "PATCHED"
  exit 0
elif [ "${MAJOR}" -eq 8 ] && [ "${MINOR}" -ge 80 ] 2>/dev/null; then
  echo "[+] Firmware version ${FW_VERSION} meets or exceeds fixed version (8.80)"
  echo "PATCHED"
  exit 0
else
  echo "[-] Firmware version ${FW_VERSION} is below fixed version (8.80 for XCC2)"
  echo "[-] Note: Fixed versions vary by model. Check LEN-156781 for your specific hardware."
  echo "[-] Known fixed versions: SN550=6.20(TEI3F2H), SR630=9.97(CDO3B4B)"
  echo "VULNERABLE"
  exit 1
fi

1. runZero Research - CVE-2024-38508 N-day Analysis
2. NVD - CVE-2024-38508 Detail
3. Lenovo Security Advisory LEN-156781
4. IBM Security Bulletin - XCC Vulnerabilities in Cloud Pak System
5. heise online - XClarity Controller Vulnerabilities
6. Lava Research - BMC Exposure Alert
7. MITRE CVE Record - CVE-2024-38508