Summary
Ein Angreifer aus einem angrenzenden Netzwerk kann mehrere Schwachstellen in Lenovo XClarity Orchestrator ausnutzen, um Informationen offenzulegen oder beliebige Betriebssystembefehle als privilegierter Benutzer auszuführen.
Product
Lenovo XClarity ist ein Verwaltungswerkzeug für Rechenzentren.
Vulnerabilities 2
-
High 8.8
Remote Command Injection via OS Profile Password in Lenovo XClarity Orchestrator
An improper neutralization of special elements used in an operating system command vulnerability was reported in Lenovo XClarity Orchestrator (LXCO) 2.2.0 that could allow an authenticated attacker to execute arbitrary operating system commands as a privilege…
-
Medium 6.1
Global TLS Certificate Validation Bypass in Lenovo XClarity Orchestrator
An improper certificate validation vulnerability was reported in multiple Lenovo XClarity Orchestrator (LXCO) 2.2.0 microservices that could allow an adjacent network attacker to intercept sensitive communications by performing a machine-in-the-middle attack …
Revision history
-
#1
Initiale Fassung
References
-
Lenovo Security Advisory LEN-216074 vom 2026-08-04
https://support.lenovo.com/us/en/product_security/LEN-216074
-
GitHub Advisory Database vom 2026-08-04
https://github.com/advisories/GHSA-HQJ6-MX68-28JM
-
GitHub Advisory Database vom 2026-08-04
https://github.com/advisories/GHSA-C9HP-JW76-R329