Lenovo XClarity Administrator (LXCA) - unauthenticated config file access: Unauthenticated access to LXCA configuration

Impact

Unauthenticated access to LXCA configuration files, which contain usernames, license keys and IP addresses. LXCA is the fleet management console that talks to every XCC it manages, so an unauthenticated read of its configuration hands an attacker a map of the whole management estate - which addresses to hit, which account names to try - without touching a single node. Combined with any of the XCC authorisation bypasses of the same era, that map is the difference between a blind scan and a targeted walk through the fleet. Affects LXCA before 2.6.6.

Who can reach it

Anything routable to the LXCA appliance, unauthenticated. No credentials, no host access, no user interaction.

What to do

Upgrade LXCA to 2.6.6 or later. Note the upgrade path: you must be on 2.6.0 before you can install the 2.6.6 fix bundle, so this is a two-step appliance upgrade, not a single jump. It is still a single appliance rather than a per-node campaign - no node reboots, no job drain, only LXCA's own downtime. Rotate anything the exposed configuration named, and put LXCA on a restricted segment rather than the general management VLAN.

References