Lenovo · the BMC layer
PWX for XClarity Controller
Lenovo XClarity Controller (XCC): the known vulnerabilities of its firmware, how to give a scanner read-only access, and the settings to check. Free, no account.
The BMC is one layer of PWX, which covers the stack from the tenant and its VMs to the host, BMC, CPU, GPU and TPU. See every layer
26 CVEs0 critical16 high0 exploited (KEV)
1. Known vulnerabilities
| CVE | Severity | Published | Summary |
|---|---|---|---|
| CVE-2024-45102 | medium 6.8 | 2025-01-14 | A privilege escalation vulnerability was discovered that could allow a valid, authenticated LXCA user to escalate their permissions for a connected XCC instance when using LXCA as a Single Sign On (SSO) provider for X... |
| CVE-2024-8281 | high 7.2 | 2024-09-13 | An input validation weakness was discovered in XCC that could allow a valid, authenticated XCC user with elevated privileges to perform command injection through specially crafted command line input in the XCC SSH cap... |
| CVE-2024-8280 | high 7.2 | 2024-09-13 | An input validation weakness was discovered in XCC that could allow a valid, authenticated XCC user with elevated privileges to perform command injection or cause a recoverable denial of service using a specially craf... |
| CVE-2024-8279 | high 7.2 | 2024-09-13 | A privilege escalation vulnerability was discovered in XCC that could allow a valid, authenticated XCC user with elevated privileges to perform command injection via specially crafted file uploads. |
| CVE-2024-8278 | high 7.2 | 2024-09-13 | A privilege escalation vulnerability was discovered in XCC that could allow a valid, authenticated XCC user with elevated privileges to perform command injection via specially crafted IPMI commands. |
| CVE-2024-8059 | medium 4.3 | 2024-09-13 | IPMI credentials may be captured in XCC audit log entries when the account username length is 16 characters. |
| CVE-2024-45101 | medium 6.8 | 2024-09-13 | A privilege escalation vulnerability was discovered when Single Sign On (SSO) is enabled that could allow an attacker to intercept a valid, authenticated LXCA user’s XCC session if they can convince the user to click ... |
| CVE-2024-38512 | high 7.2 | 2024-07-26 | A privilege escalation vulnerability was discovered in XCC that could allow an authenticated XCC user with elevated privileges to perform command injection via specially crafted IPMI commands. |
| CVE-2024-38511 | high 7.2 | 2024-07-26 | A privilege escalation vulnerability was discovered in an upload processing functionality of XCC that could allow an authenticated XCC user with elevated privileges to perform command injection via specially crafted f... |
| CVE-2024-38510 | high 7.2 | 2024-07-26 | A privilege escalation vulnerability was discovered in the SSH captive command shell interface that could allow an authenticated XCC user with elevated privileges to perform command injection via specially crafted fil... |
| CVE-2024-38509 | high 7.2 | 2024-07-26 | A privilege escalation vulnerability was discovered in XCC that could allow an authenticated XCC user with elevated privileges to execute arbitrary code via a specially crafted IPMI command. |
| CVE-2024-38508 | high 7.2 | 2024-07-26 | A privilege escalation vulnerability was discovered in the web interface or SSH captive command shell interface of XCC that could allow an authenticated XCC user with elevated privileges to perform command injection v... |
| CVE-2023-4608 | high 7.2 | 2023-10-25 | An authenticated XCC user with elevated privileges can perform blind SQL injection in limited cases through a crafted API command. This affects ThinkSystem v2 and v3 servers with XCC; ThinkSystem v1 servers are not ... |
| CVE-2023-4607 | high 8.8 | 2023-10-25 | An authenticated XCC user can change permissions for any user through a crafted API command. |
| CVE-2023-4606 | high 8.1 | 2023-10-25 | An authenticated XCC user with Read-Only permission can change a different user’s password through a crafted API command. This affects ThinkSystem v2 and v3 servers with XCC; ThinkSystem v1 servers are not affected. |
| CVE-2023-25492 | high 8.8 | 2023-05-01 | A valid, authenticated user may be able to trigger a denial of service of the XCC web user interface or other undefined behavior through a format string injection vulnerability in a web interface API. |
| CVE-2023-0683 | high 8.8 | 2023-05-01 | A valid, authenticated XCC user with read only access may gain elevated privileges through a specifically crafted API call. |
| CVE-2023-29056 | medium 5.9 | 2023-04-28 | A valid LDAP user, under specific conditions, will default to read-only permissions when authenticating into XCC. To be vulnerable, XCC must be configured to use an LDAP server for Authentication/Authorization and hav... |
| CVE-2023-25495 | medium 4.9 | 2023-04-28 | A valid, authenticated administrative user can query a web interface API to reveal the configured LDAP client password used by XCC to authenticate to an external LDAP server in certain configurations. There is no exp... |
| CVE-2023-29058 | medium 6.5 | 2023-04-28 | A valid, authenticated XCC user with read-only permissions can modify custom user roles on other user accounts and the user trespass message through the XCC CLI. There is no exposure if SSH is disabled or if there are... |
| CVE-2023-29057 | high 8.8 | 2023-04-28 | A valid XCC user's local account permissions overrides their active directory permissions under specific configurations. This could lead to a privilege escalation. To be vulnerable, LDAP must be configured for authent... |
| CVE-2021-3956 | medium 5.3 | 2022-05-18 | A read-only authentication bypass vulnerability was reported in the Third Quarter 2021 release of Lenovo XClarity Controller (XCC) firmware affecting XCC devices configured in LDAP Authentication Only Mode and using a... |
| CVE-2021-3473 | medium 4.9 | 2021-04-13 | An internal product security audit of Lenovo XClarity Controller (XCC) discovered that the XCC configuration backup/restore password may be written to an internal XCC log buffer if Lenovo XClarity Administrator (LXCA)... |
| CVE-2019-6195 | medium 4.8 | 2020-02-14 | An authorization bypass exists in Lenovo XClarity Controller (XCC) versions prior to 3.08 CDI340V, 3.01 TEI392O, 1.71 PSI328N where a valid authenticated user with lesser privileges may be granted read-only access to ... |
| CVE-2019-6187 | medium 6.5 | 2019-11-20 | A stored CSV Injection vulnerability was reported in Lenovo XClarity Controller (XCC) that could allow an administrative or other appropriately permissioned user to store malformed data in certain XCC server informati... |
All 26 XClarity Controller CVEs
Source: NVD, NVD CVE API 2.0: cpe:2.3:a:lenovo:xclarity_controller, keyword "XClarity Controller", keyword "XCC", refreshed 2026-10-29 09:17 UTC. EXPLOITED = listed in the CISA KEV catalog.
2. Give a scanner read-only access
- Web interface: BMC Configuration > User/LDAP > Local User > Create, role Read Only (view, no changes).
- XCC2 command line:
users -<n> -n pwx-ro -p <password> -r ReadOnly(first-generation XCC used-a ro). - Redfish:
POST /redfish/v1/AccountService/Accounts; predefined RoleIds Administrator, Operator, ReadOnly.
Sources: XCC2 user accounts · XCC2 users command · XCC2 REST: create an account · XCC2 REST: roles
3. Settings that open the power path
From Lenovo Press LP1260:
- IPMI over LAN off (
/redfish/v1/Managers/1/NetworkProtocol IPMI.ProtocolEnabled = false); IPMI over KCS off. - SSH off if unneeded; SNMPv3 only; HTTP port 80 closed.
- Account lockout and minimum password length per policy (
AccountLockoutThreshold,MinPasswordLength). - Ethernet over USB, the host interface, off (
HostInterfaces InterfaceEnabled = false). - Remote presence off when unused, security mode Enterprise Strict, TLS 1.2 or later.
Sources: Lenovo Press LP1260: harden a ThinkSystem server · XCC2 REST: network services · XCC2 REST: account policy · XCC2 REST: host interface
Standard Redfish checks
| Redfish property | Want | Why |
|---|---|---|
| NetworkProtocol IPMI.ProtocolEnabled | false | IPMI 2.0 RAKP leaks password hashes to anyone who can reach the port (CVE-2013-4786). |
| NetworkProtocol Telnet.ProtocolEnabled | false | Credentials and commands travel in clear text. |
| NetworkProtocol HTTP.ProtocolEnabled | false | The web and Redfish interface is reachable without TLS. |
| NetworkProtocol SNMP.EnableSNMPv1 / EnableSNMPv2c | false (SNMPv3 only) | No authentication beyond a clear-text community string. |
| AccountService AccountLockoutThreshold | greater than 0 | With 0, BMC passwords can be guessed without limit. |
| HostInterface AuthenticationModes | no AuthNone | AuthNone lets any process on the host drive the BMC, and through it the power path, without credentials. |
| HostInterface CredentialBootstrapping.Enabled | false | The host OS can mint its own BMC account at any time. |
| Accounts with RoleId Administrator | one break-glass account | Each administrator can rewrite the power path. |
The Redfish Inspector checks each of these for you.
Vendor security advisories: support.lenovo.com/us/en/product_security/home. New CVEs also appear in PWX news.
4. Check it
- One BMC, in your browser: collect its Redfish answers and paste them into the Redfish Inspector. On XClarity Controller the manager is usually
/redfish/v1/Managers/1. - All of them, from one machine that reaches the BMC network:
Every request is a GET and is written to a log next to the result. Nothing is sent anywhere else.curl -fsSL https://get.bareket.ai/pgdiscover | sh pgdiscover up 10.0.7.0/24 --credentials pwx-ro.cred --insecure - See what continuous monitoring adds: the Stack sandbox.
Free e-mail alerts
Get an e-mail when a new CVE lands for what you run
Run it on your own fleet
PWX Discover is free: the scan reads your fleet and lists what to fix, on your machine. PWX Monitor keeps watching every layer, from the tenant to the power rail, with attack paths and alerts in your SIEM. PWX Protect acts on the BMC. Start with a pilot.