Lenovo XClarity Controller (XCC) - user account API: A read-only XCC user can change any other user's password through

Impact

A read-only XCC user can change any other user's password through a crafted API call. That is a direct path from the least-privileged BMC account you hand out to full administrative control of the service processor: change the admin's password, log in as admin, and you have power control, remote media, console and firmware on the node. It also locks out the legitimate administrator, which turns a quiet compromise into a visible outage. Affects ThinkSystem V2 and V3 servers - the generations that carry the SR670 V2 / SR675 V3 / SR685a GPU platforms. V1 servers are not affected.

Who can reach it

An authenticated XCC account holding only read-only permission - typically a monitoring collector, a DCIM integration, or an account issued to remote hands. Reachable over the out-of-band management VLAN.

What to do

Flash XCC to the per-model version listed in Lenovo's advisory - out-of-band, per-node, no host reboot and no drain of running jobs. Model-specific version floors mean you cannot use one target build across a mixed fleet; pull the table from LEN-140960 and drive the campaign per SKU. Config-only mitigation in the meantime: audit and prune read-only XCC accounts, since 'read-only' provides no protection against this bug.

References