Lenovo XClarity Controller (XCC) - LDAP/AD authorization: When XCC is configured to authenticate against Active

CVSS 7.3CVE-2023-29057Firmware, BMC & network fabricLEN-118321curated

Impact

When XCC is configured to authenticate against Active Directory, a user's local XCC account permissions silently override the permissions their directory group grants - and the local ones can be higher. The result is privilege escalation that your identity provider cannot see: you revoke someone's admin rights in AD, XCC keeps honouring the stale local grant, and they retain out-of-band control of the node. For an operator this is a offboarding and least-privilege failure more than an exploit, which makes it easy to miss - nothing looks broken, and the directory tells you the access is gone.

Who can reach it

A valid XCC user in a deployment where LDAP/AD is configured for authentication and authorisation and the user also has a local XCC account. No exploit code required - the misbehaviour is in the authorisation logic itself.

What to do

Flash XCC to the version listed for your model in LEN-118321 - out-of-band, per-node, no host reboot and no drain. Alongside the flash, do the config work that actually closes the gap: enumerate local XCC accounts on every node and delete the ones that shadow directory identities, because patching the precedence logic does not remove local accounts that are already there.

References

https://support.lenovo.com/us/en/product_security/LEN-118321 https://nvd.nist.gov/vuln/detail/CVE-2023-29057

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.