Database/Firmware, BMC & network fabric
Lenovo XClarity Essentials OneCLI: crafted remote path injects OS commands on managed servers
Impact
In OneCLI 5.5.0 for Linux, the remote SSH operation does not sanitize the remote path, so a specially crafted path can run arbitrary OS commands on the managed server. The commands run with the privileges of the SSH account OneCLI is configured with, which in server-management setups is often a privileged account. Operators who push firmware and configuration updates to many Lenovo servers from one management host are the ones exposed.
Who can reach it
A low-privileged attacker who can supply the remote path to a OneCLI remote SSH operation. Attack complexity is high. Commands run on the managed server, not on the management host.
What to do
Follow Lenovo advisory HT116433 for the fixed OneCLI release and upgrade the tool on management hosts. Only the management host's tool needs upgrading, with no node downtime. The record names 5.5.0 as affected but not the fixed version. Until then, do not pass untrusted input as OneCLI remote paths.
References
Related entries
- Arista EOS (tunnel decapsulation): With VXLAN, decap-groups or GRE configured, the switch incorrectly decapsulates andCVE-2026-7473 · Arista EOS (tunnel decapsulation)Medium
- GRUB2 (initrd size handling): Integer overflows in the initrd command's size arithmetic corrupt GRUB's heapCVE-2020-15707 · GRUB2 (initrd size handling)Medium
- GRUB2 (PNG grayscale reader): Out-of-bounds write on the grayscale PNG pathCVE-2021-3696 · GRUB2 (PNG grayscale reader)Medium
- AMI MegaRAC SPx (BMC web interface, HTTP header handling): CRLF sequences are not neutralised in HTTP headers, soCVE-2023-34472 · AMI MegaRAC SPx (BMC web interface, HTTP header handling)Medium
- AMD Secure Processor - cryptographic key usage control: Once an attacker has arbitrary code execution inside the ASPCVE-2024-21981 · AMD Secure Processor - cryptographic key usage controlMedium
- AMD EPYC / Instinct MI300A: improper LFENCE serialization allows speculation-barrier bypassCVE-2024-36315 · AMD EPYC and Instinct MI300A processors (LFENCE serialization enforcement)Medium
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.