Lenovo XClarity Controller (XCC) - API privilege escalation: A read-only XCC user gains elevated privileges through

Impact

A read-only XCC user gains elevated privileges through a specifically crafted API call. Same shape as the later 2023 XCC batch and the same consequence: a monitoring-tier credential becomes control of the service processor, which means out-of-band power, Virtual Media boot of an attacker image, console into whatever the tenant is running, and firmware-level persistence that survives reimaging. Taken together with CVE-2023-4606 and CVE-2023-4607, this is a pattern rather than an isolated defect - XCC's API-side authorisation checks were repeatedly incomplete across 2023.

Who can reach it

An authenticated XCC account with read-only access, reaching the XCC API over the out-of-band management VLAN.

What to do

Flash XCC to the version listed for your model in LEN-99936. Out-of-band, per-node, no host reboot and no job drain. Sequence it with the other 2023 XCC advisories so each node is touched once. Given three independent authorisation bypasses in the same year, the durable posture is to stop treating XCC read-only accounts as low-risk and to gate the XCC management segment tightly.

References