{"cve":"CVE-2023-4606","nvd":{"published":"2023-10-25T18:17:41.487","modified":"2026-06-17T06:38:12.253","status":"Modified","description":"An authenticated XCC user with Read-Only permission can change a different user’s password through a crafted API command.  \n\nThis affects ThinkSystem v2 and v3 servers with XCC; ThinkSystem v1 servers are not affected.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","score":8.1},"cwes":["CWE-862"],"references":["https://support.lenovo.com/us/en/product_security/LEN-140960","https://support.lenovo.com/us/en/product_security/LEN-140960"],"products":["lenovo:thinkagile_hx1331_firmware","lenovo:thinkagile_hx2330_firmware","lenovo:thinkagile_hx2331_firmware","lenovo:thinkagile_hx3330_firmware","lenovo:thinkagile_hx3331_firmware","lenovo:thinkagile_hx3375_firmware","lenovo:thinkagile_hx3376_firmware","lenovo:thinkagile_hx5530_firmware","lenovo:thinkagile_hx5531_firmware","lenovo:thinkagile_hx7530_firmware","lenovo:thinkagile_hx7531_firmware","lenovo:thinkagile_mx3330-f_all-flash_firmware","lenovo:thinkagile_mx3330-h_hybrid_firmware","lenovo:thinkagile_mx3331-f_all-flash_firmware","lenovo:thinkagile_mx3331-h_hybrid_firmware","lenovo:thinkagile_mx3530-h_hybrid_firmware","lenovo:thinkagile_mx3530_f_all_flash_firmware","lenovo:thinkagile_mx3531-f_all-flash_firmware","lenovo:thinkagile_mx3531_h_hybrid_firmware","lenovo:thinkagile_vx2330_firmware","lenovo:thinkagile_vx3330_firmware","lenovo:thinkagile_vx3331_firmware","lenovo:thinkagile_vx3530-g_firmware","lenovo:thinkagile_vx5530_firmware","lenovo:thinkagile_vx7330_firmware","lenovo:thinkagile_vx7530_firmware","lenovo:thinkagile_vx7531_firmware","lenovo:thinksystem_sd630_v2_firmware","lenovo:thinksystem_sd650-n_v2_firmware","lenovo:thinksystem_sd650_v2_firmware","lenovo:thinksystem_sd650_v3_firmware","lenovo:thinksystem_sd665_v3_firmware","lenovo:thinksystem_sn550_v2_firmware","lenovo:thinksystem_sr250_firmware","lenovo:thinksystem_sr258_v2_firmware","lenovo:thinksystem_sr630_v2_firmware","lenovo:thinksystem_sr630_v3_firmware","lenovo:thinksystem_sr635_v3_firmware","lenovo:thinksystem_sr645_firmware","lenovo:thinksystem_sr645_v3_firmware","lenovo:thinksystem_sr650_v2_firmware","lenovo:thinksystem_sr650_v3_firmware","lenovo:thinksystem_sr655_v3_firmware","lenovo:thinksystem_sr665_firmware","lenovo:thinksystem_sr665_v3_firmware","lenovo:thinksystem_sr670_firmware","lenovo:thinksystem_sr670_v2_firmware","lenovo:thinksystem_sr675_v3_firmware","lenovo:thinksystem_sr850_v2_firmware","lenovo:thinksystem_sr850_v3_firmware"],"source":"nvd","synced_at":"2026-10-19T21:40:11.519948003+00:00"},"epss":{"cve":"CVE-2023-4606","score":0.00556,"percentile":0.46377,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}