← Vulnerability feed

Vulnerability record · CVE-2022-34888 · published 30 January 2023

CVE-2022-34888: Lenovo thinkagile vx3331 firmware vulnerability

Lenovo · Thinkagile Vx3331 Firmware

The Remote Mount feature can potentially be abused by valid, authenticated users to make connections to internal services that may not normally be accessible to users. Internal service access controls, as applicable, remain in effect.

4.3 CVSS 3.1 Medium EPSS 0.41% · top 65.8% CWE-184 · CWE-184CWE-697 · CWE-697
4.3CVSS 3.1 base score
0.41%EPSS exploitation probability, 30 days
NoNot in CISA KEV
98Affected product versions listed by NVD
2References
17 Jun 2026Last modified by NVD

Description

The Remote Mount feature can potentially be abused by valid, authenticated users to make connections to internal services that may not normally be accessible to users. Internal service access controls, as applicable, remain in effect.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Affected products

98 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://support.lenovo.com/us/en/product_security/LEN-87734 Vendor Advisory
https://support.lenovo.com/us/en/product_security/LEN-87734 Vendor Advisory

Track CVE-2022-34888 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2021-3849Lenovo nextscale n1200 enclosure firmware authentication bypass via alternate path vulnerabilityAn authentication bypass vulnerability was discovered in the web interface of the Lenovo Fan Power Controller2 (FPC2) and Lenovo System Management Mo…EPSS 1.3%9.8CVE-2021-3897Lenovo nextscale n1200 enclosure firmware authentication bypass via alternate path vulnerabilityAn authentication bypass vulnerability was discovered in an internal service of the Lenovo Fan Power Controller2 (FPC2) and Lenovo System Management …EPSS 1.3%8.8CVE-2023-4607Lenovo thinkagile hx5530 firmware improper privilege management vulnerabilityAn authenticated XCC user can change permissions for any user through a crafted API command.EPSS 0.52%8.8CVE-2023-25492Lenovo thinkagile hx5530 firmware vulnerabilityA valid, authenticated user may be able to trigger a denial of service of the XCC web user interface or other undefined behavior through a format str…EPSS 0.51%8.8CVE-2023-0683Lenovo thinkagile hx5530 firmware improper input validation vulnerabilityA valid, authenticated XCC user with read only access may gain elevated privileges through a specifically crafted API call.EPSS 0.57%8.8CVE-2023-29057Lenovo thinkagile hx5530 firmware incorrect default permissions vulnerabilityA valid XCC user's local account permissions overrides their active directory permissions under specific configurations. This could lead to a privile…EPSS 0.50%7.5CVE-2023-2992Lenovo nextscale n1200 enclosure firmware vulnerabilityAn unauthenticated  denial of service vulnerability exists in the SMM v1, SMM v2, and FPC management web server which can be triggered under crafted …EPSS 0.62%7.2CVE-2024-2659Lenovo nextscale n1200 enclosure firmware os command injection vulnerabilityA command injection vulnerability was identified in SMM/SMM2 and FPC that could allow an authenticated user with elevated privileges to execute syste…EPSS 1.1%

Source: NIST National Vulnerability Database (record CVE-2022-34888), CISA KEV, FIRST EPSS (scores of 2026-10-17). This page is refreshed as NVD updates the record.