Lenovo XClarity Controller (XCC) - permission API: An authenticated XCC user can change the permissions of any user

Impact

An authenticated XCC user can change the permissions of any user through a crafted API command - including their own. Fixed in the same advisory as the password-change flaw and with the same practical result: whatever limited BMC account you issued becomes an administrative one, and the attacker inherits out-of-band power control, Virtual Media boot, console access and firmware update rights on the node. The privilege model in this XCC generation should be treated as advisory rather than enforcing until patched.

Who can reach it

Any authenticated XCC account, at any privilege level, reaching the XCC over the out-of-band management VLAN.

What to do

Flash XCC to the per-model version in LEN-140960 - out-of-band, per-node, no host reboot, no job drain. Because the fix is per-SKU, treat it as one campaign covering both this and CVE-2023-4606. Until patched, the only real control is reducing the number of XCC accounts that exist at all, since privilege tiers are not a boundary here.

References