Loading story…
runZero disclosed technical details of CVE-2024-38508, a command-injection vulnerability in Lenovo XClarity Controller 2 (XCC2) BMC firmware. An authenticated user with the Operator role and Remote-Media privileges can craft remote-media connection parameters to execute arbitrary commands as root, potentially compromising the server’s out-of-band management controller.
Lenovo identified, fixed, and disclosed the vulnerability in 2024 through its XClarity Controller security advisory. The issue affects older firmware releases, including version 1.10; current XCC2 firmware version 8.80 is not affected. runZero’s rediscovery was initially assigned CVE-2026-65201 before being confirmed as a duplicate of CVE-2024-38508, underscoring the need to identify and update BMCs that may remain on legacy firmware.
See affected versions and whether adversaries are exploiting it.
10 events from the most recent confirmed update back to the earliest known activity.
runZero publicly disclosed technical details showing that an authenticated Operator-class user with Remote-Media privileges could inject commands through remote-media connection parameters and execute them as root on vulnerable XCC2 controllers.
runZero confirmed with CERT/CC that CVE-2024-38508, rather than CVE-2026-65201, was the correct identifier for the rediscovered vulnerability.
Lenovo informed CERT/CC that runZero's reported issue duplicated the previously disclosed CVE-2024-38508.
CERT/CC notified Lenovo about runZero's reported XCC2 vulnerability.
runZero submitted its finding to CERT/CC through the VINCE platform as VU#216901.
runZero initially reserved CVE-2026-65201 for its rediscovered XCC2 remote-media command-injection finding.
During its Lights Out BMC security research, runZero documented findings showing that crafted remote-media parameters could lead to root command execution on affected XCC2 controllers.
Lenovo released XCC2 firmware version 8.80, which Lenovo said is not vulnerable to the reported issue.
Lenovo stated that it internally discovered, fixed, and publicly disclosed CVE-2024-38508, a command-injection/privilege-escalation issue in XClarity Controller interfaces.
Lenovo released XClarity Controller 2 firmware version 1.10, an older firmware version affected by the later-identified command-injection flaw.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Cisco disclosed **CVE-2026-20200**, a high-severity argument injection flaw in the web-based management interface of Cisco Integrated Management Controller (**IMC**) that allows an authenticated low-privilege attacker to execute arbitrary commands as `root`. The vulnerability, scored **CVSS 8.8**, affects multiple Cisco Unified Computing System standalone releases in the 4.3 and 6.0 branches, and Cisco urged customers to apply updates, validate management-interface inputs, and limit privileges for authenticated users. At the same time, research presented by runZero and reported from Black Hat 2026 warned that baseboard management controllers (**BMCs**) across major vendors remain broadly exposed and vulnerable to takeover. runZero said it found multiple flaws affecting platforms including **OpenBMC, Supermicro IPMI, HPE iLO, Dell iDRAC, AMI MegaRAC, Raritan, H3C HDM, and Fujitsu BMC**, while scans cited by Ars Technica identified more than **86,000** Internet-exposed BMCs and found over **54%** with at least one critical weakness. Researchers said exploitation can enable persistent server backdoors, lateral movement, and segmentation bypass, and recommended isolating BMC interfaces from the public Internet, monitoring vendor advisories, patching promptly, and disabling legacy management features such as IPMI and KCS where possible.
Aug 6, 2026
Lenovo disclosed **CVE-2025-13154**, an improper link following vulnerability in the `SmartPerformanceAddin` component of **Lenovo Vantage** that could let an authenticated local user delete arbitrary files with elevated privileges. The company said the flaw could lead to **denial of service** and **privilege escalation**, rated it **Medium** severity, and described the impact as Lenovo-specific. Lenovo credited Alex Lee Tsz Hin of PwCHK and Manuel Kiesel of cyllective AG together with John Ostrowski of Compass Security for reporting the issue. Lenovo advised customers to update **Vantage SmartPerformanceAddin** to version **1.1.0.1111** or later, noting that the component is normally updated automatically through Lenovo Vantage. Separate Lenovo and Intel advisories in the same set also reference security issues affecting Intel Ethernet adapters and controllers, including Intel advisory **`INTEL-SA-00918`**, indicating ongoing vendor remediation activity across Lenovo-supported hardware and software components.
Jun 29, 2026
BMC Control-M deployments are affected by two newly disclosed vulnerabilities that expose `Control-M/Server` and related components to serious remote attacks. **CVE-2026-10539** is a critical unauthenticated command injection flaw in Control-M/Server communication commands that can let a remote attacker execute unauthorized commands and potentially fully compromise a server. The issue affects `Control-M/Server` versions `9.0.20.x` through `9.0.21.200`, and possibly earlier unsupported releases, and is rated `CVSS 4.0 9.5` / `CVSS 3.1 9.0`. A second issue, **CVE-2026-10538**, is a high-severity improper deserialization vulnerability in out-of-support `Control-M/Server` and `Control-M/Enterprise Manager` `9.0.20.x` components, particularly in messaging consumer functionality that processes user-controlled serialized data. An authenticated attacker could remotely trigger unintended server-side behavior through crafted serialized content; the flaw is rated `CVSS 4.0 8.9` / `CVSS 3.1 8.0`. Organizations running affected Control-M versions have been advised to upgrade to supported releases, apply vendor patches, harden deserialization controls, restrict access to exposed services, and monitor for suspicious command execution or messaging activity.
Jul 3, 2026