Lenovo XClarity Controller (XCC) - user account API: A read-only XCC user can change any other user's password through

Impact

A read-only XCC user can change any other user's password through a crafted API call. That is a direct path from the least-privileged BMC account you hand out to full administrative control of the service processor: change the admin's password, log in as admin, and you have power control, remote media, console and firmware on the node. It also locks out the legitimate administrator, which turns a quiet compromise into a visible outage. Affects ThinkSystem V2 and V3 servers - the generations that carry the SR670 V2 / SR675 V3 / SR685a GPU platforms. V1 servers are not affected.

Who can reach it

An authenticated XCC account holding only read-only permission - typically a monitoring collector, a DCIM integration, or an account issued to remote hands. Reachable over the out-of-band management VLAN.

What to do

Flash XCC to the per-model version listed in Lenovo's advisory - out-of-band, per-node, no host reboot and no drain of running jobs. Model-specific version floors mean you cannot use one target build across a mixed fleet; pull the table from LEN-140960 and drive the campaign per SKU. Config-only mitigation in the meantime: audit and prune read-only XCC accounts, since 'read-only' provides no protection against this bug.

References

Related entries

• OpenBMC phosphor-net-ipmid: unauthenticated RAKP handler leaves default key, allowing BMC login bypassCVE-2026-16141 · OpenBMC phosphor-net-ipmid (IPMI 2.0 RAKP session authentication)High
• IBM PowerVM partition firmware: unauthenticated attacker on the boot VLAN can substitute a netboot imageCVE-2026-17414 · IBM PowerVM partition firmware (network boot)High
• IBM Power Systems Firmware: BMC/FSP root can write arbitrary hardware control registers and take the hostCVE-2026-17429 · IBM Power Systems Firmware (BMC/FSP-to-host register interface)High
• Dell SmartFabric Manager: insufficient verification of data authenticity allows privilege elevationCVE-2026-26950 · Dell SmartFabric Manager (data authenticity verification)High
• Dell OpenManage Enterprise: low-privileged remote user can inject SQL into the management consoleCVE-2026-70422 · Dell OpenManage Enterprise (management console, SQL injection)High
• Dell OMSA: improper privilege management lets a low-privileged remote user tamper with the nodeCVE-2026-81442 · Dell OpenManage Server Administrator (privilege management)High