Lenovo XClarity Controller (XCC) Vulnerabilities
Lenovo XClarity Controller (XCC) Vulnerabilities
Lenovo XClarity Controller (XCC) Vulnerabilities
Lenovo Security Advisory: LEN-118321
Potential Impact: Privilege Escalation
Severity: High
Scope of Impact: Lenovo-specific
CVE Identifier: CVE-2023-29056, CVE-2023-29057, CVE-2023-29058
Summary Description:
An internal product security audit of Lenovo XClarity Controller (XCC) discovered the below vulnerabilities:
CVE-2023-29056: A valid LDAP user, under specific conditions, will default to read-only permissions when authenticating into XCC. To be vulnerable, XCC must be configured to use an LDAP server for Authentication/Authorization and have the login permission attribute not defined.
CVE-2023-29057: A valid XCC user's local account permissions overrides their active directory permissions under specific configurations. This could lead to a privilege escalation. To be vulnerable, LDAP must be configured for authentication/authorization and logins configured as “Local First, then LDAP”.
CVE-2023-29058: A valid, authenticated XCC user with read-only permissions can modify custom user roles on other user accounts and the user trespass message through the XCC CLI. There is no exposure if SSH is disabled or if there are no users assigned optional read-only permissions.
Mitigation Strategy for Customers (what you should do to protect yourself):
Update to the Lenovo XClarity Controller (XCC) version (or higher) as recommended in the Product Impact section below.
Follow general security best practices, such as limiting access to only trusted users within the network.
To download the version specified for your product below, follow these steps:
Navigate to the Drivers & Software support site for your product:
- Lenovo Products (sold worldwide, except in China): https://support.lenovo.com/
- Lenovo Products (sold in China): https://newsupport.lenovo.com.cn/
- IBM-branded System x Legacy Products: https://www.ibm.com/support/fixcentral/
- Search for your product by name or machine type.
- Click Drivers & Software on the left menu panel.
- Click on Manual Update to browse by Component type.
- Compare the minimum fix version for your product from the applicable product table below with the latest version posted on the support site.
Lenovo also offers tools to assist with update management as an alternative to the manual steps described above. Refer to the following for additional help:
PC Products and Software: https://support.lenovo.com/us/en/solutions/ht504759
Server and Enterprise Software: https://support.lenovo.com/us/en/solutions/lnvo-lxcaupd and https://datacentersupport.lenovo.com/us/en/documents/lnvo-center
Click below links to view affected products:
Revision History:
| Revision | Date | Description |
|---|---|---|
| 2 | 2023-09-21 | Updated product impact |
| 1 | 2023-04-11 | Initial release |
For a complete list of all Lenovo Product Security Advisories, click here.
For the most up to date information, please remain current with updates and advisories from Lenovo regarding your equipment and software. The information provided in this advisory is provided on an “as is” basis without any warranty or guarantee of any kind. Lenovo reserves the right to change or update this advisory at any time.
Product Impact:
| Product | Component | Minimum Fixed Version |
| HX5530 Appliance (ThinkAgile) | Lenovo XClarity Controller (XCC) Update (For AnyOS) | (2.93) AFBT30P |
| HX7530 Appliance (ThinkAgile) | Lenovo XClarity Controller (XCC) Update (For AnyOS) | (2.93) AFBT30P |
| VX3331 Certified Node (ThinkAgile) | Lenovo XClarity Controller (XCC) Update (For AnyOS) | (2.93) AFBT30P |
| HX Enclosure Certified Node (ThinkAgile) | Lenovo XClarity Controller (XCC) Update (For AnyOS) | (3.72) TEI388S |
| HX1021 Edge Certified Node 3yr (ThinkAgile) | Lenovo XClarity Controller (XCC) (For AnyOS) | (3.72) TEI388S |
| HX1320 Appliance (ThinkAgile) | Lenovo XClarity Controller (XCC) for SR530,SR550,SR570,SR590,SR630,SR650,ST550,ST558,HX Series,VX Series | (8.88) CDI3A4A |
| HX1321 Certified Node (ThinkAgile) | Lenovo XClarity Controller (XCC) for SR530,SR550,SR570,SR590,SR630,SR650,ST550,ST558,HX Series,VX Series | (8.88) CDI3A4A |
| HX1331 Certified Node (ThinkAgile) | Lenovo XClarity Controller (XCC) Update (For AnyOS) | (2.93) AFBT30P |
| HX1520-R Appliance (ThinkAgile) | Lenovo XClarity Controller (XCC) for SR530,SR550,SR570,SR590,SR630,SR650,ST550,ST558,HX Series,VX Series | (8.88) CDI3A4A |
| HX1521-R Certified Node (ThinkAgile) | Lenovo XClarity Controller (XCC) for SR530,SR550,SR570,SR590,SR630,SR650,ST550,ST558,HX Series,VX Series | (8.88) CDI3A4A |
| HX2320-E Appliance (ThinkAgile) | Lenovo XClarity Controller (XCC) for SR530,SR550,SR570,SR590,SR630,SR650,ST550,ST558,HX Series,VX Series | (8.88) CDI3A4A |
| HX2321 Certified Node (ThinkAgile) | Lenovo XClarity Controller (XCC) for SR530,SR550,SR570,SR590,SR630,SR650,ST550,ST558,HX Series,VX Series | (8.88) CDI3A4A |
| HX2330 Appliance (ThinkAgile) | Lenovo XClarity Controller (XCC) Update (For AnyOS) | (2.93) AFBT30P |
| HX2331 Certified Node (ThinkAgile) | Lenovo XClarity Controller (XCC) Update (For AnyOS) | (2.93) AFBT30P |
| HX2720-E Appliance (ThinkAgile) | Lenovo XClarity Controller (XCC) Update (For AnyOS) | (3.72) TEI388S |
| HX3320 Appliance (ThinkAgile) | Lenovo XClarity Controller (XCC) for SR530,SR550,SR570,SR590,SR630,SR650,ST550,ST558,HX Series,VX Series | (8.88) CDI3A4A |
| HX3321 Certified Node (ThinkAgile) | Lenovo XClarity Controller (XCC) for SR530,SR550,SR570,SR590,SR630,SR650,ST550,ST558,HX Series,VX Series | (8.88) CDI3A4A |
| HX3330 Appliance (ThinkAgile) | Lenovo XClarity Controller (XCC) Update (For AnyOS) | (2.93) AFBT30P |
| HX3331 Certified Node (ThinkAgile) | Lenovo XClarity Controller (XCC) Update (For AnyOS) | (2.93) AFBT30P |
| HX3331 Node SAP HANA (ThinkAgile) | Lenovo XClarity Controller (XCC) Update (For AnyOS) | (2.93) AFBT30P |
| HX3375 Appliance (ThinkAgile) | Lenovo XClarity Controller (XCC) Update (For AnyOS) | (4.71) D8BT48P |
| HX3376 Certified Node (ThinkAgile) | Lenovo XClarity Controller (XCC) Update (For AnyOS) | (4.71) D8BT48P |
| HX3520-G Appliance (ThinkAgile) | Lenovo XClarity Controller (XCC) for SR530,SR550,SR570,SR590,SR630,SR650,ST550,ST558,HX Series,VX Series | (8.88) CDI3A4A |
| HX3521-G Certified Node (ThinkAgile) | Lenovo XClarity Controller (XCC) for SR530,SR550,SR570,SR590,SR630,SR650,ST550,ST558,HX Series,VX Series | (8.88) CDI3A4A |
| HX3720 Appliance (ThinkAgile) | Lenovo XClarity Controller (XCC) Update (For AnyOS) | (3.72) TEI388S |
| HX3721 Certified Node (ThinkAgile) | Lenovo XClarity Controller (XCC) Update (For AnyOS) | (3.72) TEI388S |
| HX5520 Appliance (ThinkAgile) | Lenovo XClarity Controller (XCC) for SR530,SR550,SR570,SR590,SR630,SR650,ST550,ST558,HX Series,VX Series | (8.88) CDI3A4A |
| HX5520-C Appliance (ThinkAgile) | Lenovo XClarity Controller (XCC) for SR530,SR550,SR570,SR590,SR630,SR650,ST550,ST558,HX Series,VX Series | (8.88) CDI3A4A |
| HX5521 Certified Node (ThinkAgile) | Lenovo XClarity Controller (XCC) for SR530,SR550,SR570,SR590,SR630,SR650,ST550,ST558,HX Series,VX Series | (8.88) CDI3A4A |
| HX5521-C Certified Node (ThinkAgile) | Lenovo XClarity Controller (XCC) for SR530,SR550,SR570,SR590,SR630,SR650,ST550,ST558,HX Series,VX Series | (8.88) CDI3A4A |
| HX5531 Certified Node (ThinkAgile) | Lenovo XClarity Controller (XCC) Update (For AnyOS) | (2.93) AFBT30P |
| HX7520 Appliance (ThinkAgile) | Lenovo XClarity Controller (XCC) for SR530,SR550,SR570,SR590,SR630,SR650,ST550,ST558,HX Series,VX Series | (8.88) CDI3A4A |
| HX7521 Certified Node (ThinkAgile) | Lenovo XClarity Controller (XCC) for SR530,SR550,SR570,SR590,SR630,SR650,ST550,ST558,HX Series,VX Series | (8.88) CDI3A4A |
| HX7530 Appl for SAP HANA (ThinkAgile) | Lenovo XClarity Controller (XCC) Update (For AnyOS) | (2.93) AFBT30P |
| HX7531 Certified Node (ThinkAgile) | Lenovo XClarity Controller (XCC) Update (For AnyOS) | (2.93) AFBT30P |
| HX7531 Node SAP HANA (ThinkAgile) | Lenovo XClarity Controller (XCC) Update (For AnyOS) | (2.93) AFBT30P |
| HX7820 Appliance (ThinkAgile) | Lenovo XClarity Controller (XCC) Update (For AnyOS) | (2.75) PSI348S |
| HX7821 Certified Node (ThinkAgile) | Lenovo XClarity Controller (XCC) Update (For AnyOS) | (2.75) PSI348S |
| MX Edge Appliance - MX1020 (ThinkAgile) | Lenovo XClarity Controller (XCC) (For AnyOS) | (3.72) TEI388S |
| MX3330-F All-flash Appliance (ThinkAgile) | Lenovo XClarity Controller (XCC) Update (For AnyOS) | (2.93) AFBT30P |
| MX3330-H Hybrid Appliance (ThinkAgile) | Lenovo XClarity Controller (XCC) Update (For AnyOS) | (2.93) AFBT30P |
| MX3331-F All-flash Certified node (ThinkAgile) | Lenovo XClarity Controller (XCC) Update (For AnyOS) | (2.93) AFBT30P |
| MX3331-H Hybrid Certified node (ThinkAgile) | Lenovo XClarity Controller (XCC) Update (For AnyOS) | (2.93) AFBT30P |
| MX3530 F All flash Appliance (ThinkAgile) | Lenovo XClarity Controller (XCC) Update (For AnyOS) | (2.93) AFBT30P |
| MX3530-H Hybrid Appliance (ThinkAgile) | Lenovo XClarity Controller (XCC) Update (For AnyOS) | (2.93) AFBT30P |
| MX3531 H Hybrid Certified node (ThinkAgile) | Lenovo XClarity Controller (XCC) Update (For AnyOS) | (2.93) AFBT30P |
| MX3531-F All-flash Certified node (ThinkAgile) | Lenovo XClarity Controller (XCC) Update (For AnyOS) | (2.93) AFBT30P |
| ThinkAgile MX1021 on SE350 | Lenovo XClarity Controller (XCC) (For AnyOS) | (3.72) TEI388S |
| ThinkAgile MX1021 on SE350 | Lenovo XClarity Controller (XCC) for ThinkSystem SE350 (For AnyOS) | (3.72) TEI388S |
| VX 1SE Certified Node (ThinkAgile) | Lenovo XClarity Controller (XCC) Update (For AnyOS) | (3.72) TEI388S |
| VX 2U4N Certified Node (ThinkAgile) | Lenovo XClarity Controller (XCC) Update (For AnyOS) | (3.72) TEI388S |
| VX 4U Certified Node (ThinkAgile) | Lenovo XClarity Controller (XCC) Update (For AnyOS) | (2.75) PSI348S |
| VX1320 (ThinkAgile) | Lenovo XClarity Controller (XCC) Update (For AnyOS) | (3.72) TEI388S |
| VX2320 (ThinkAgile) | Lenovo XClarity Controller (XCC) for SR530,SR550,SR570,SR590,SR630,SR650,ST550,ST558,HX Series,VX Series | (8.88) CDI3A4A |
| VX2330 Appliance (ThinkAgile) | Lenovo XClarity Controller (XCC) Update (For AnyOS) | (2.93) AFBT30P |
| VX3320 (ThinkAgile) | Lenovo XClarity Controller (XCC) for SR530,SR550,SR570,SR590,SR630,SR650,ST550,ST558,HX Series,VX Series | (8.88) CDI3A4A |
| VX3330 Appliance (ThinkAgile) | Lenovo XClarity Controller (XCC) Update (For AnyOS) | (2.93) AFBT30P |
| VX3520-G (ThinkAgile) | Lenovo XClarity Controller (XCC) for SR530,SR550,SR570,SR590,SR630,SR650,ST550,ST558,HX Series,VX Series | (8.88) CDI3A4A |
| VX3530-G Appliance (ThinkAgile) | Lenovo XClarity Controller (XCC) Update (For AnyOS) | (2.93) AFBT30P |
| VX3720 (ThinkAgile) | Lenovo XClarity Controller (XCC) Update (For AnyOS) | (3.72) TEI388S |
| VX5520 (ThinkAgile) | Lenovo XClarity Controller (XCC) for SR530,SR550,SR570,SR590,SR630,SR650,ST550,ST558,HX Series,VX Series | (8.88) CDI3A4A |
| VX5530 Appliance (ThinkAgile) | Lenovo XClarity Controller (XCC) Update (For AnyOS) | (2.93) AFBT30P |
| VX7320 N (ThinkAgile) | Lenovo XClarity Controller (XCC) for SR530,SR550,SR570,SR590,SR630,SR650,ST550,ST558,HX Series,VX Series | (8.88) CDI3A4A |
| VX7330 Appliance (Thinkagile) | Lenovo XClarity Controller (XCC) Update (For AnyOS) | (2.93) AFBT30P |
| VX7520 (ThinkAgile) | Lenovo XClarity Controller (XCC) for SR530,SR550,SR570,SR590,SR630,SR650,ST550,ST558,HX Series,VX Series | (8.88) CDI3A4A |
| VX7520 N (ThinkAgile) | Lenovo XClarity Controller (XCC) for SR530,SR550,SR570,SR590,SR630,SR650,ST550,ST558,HX Series,VX Series | (8.88) CDI3A4A |
| VX7530 Appliance (ThinkAgile) | Lenovo XClarity Controller (XCC) Update (For AnyOS) | (2.93) AFBT30P |
| VX7531 Certified Node (ThinkAgile) | Lenovo XClarity Controller (XCC) Update (For AnyOS) | (2.93) AFBT30P |
| VX7820 (ThinkAgile) | Lenovo XClarity Controller (XCC) Update (For AnyOS) | (2.75) PSI348S |
| Product | Component | Minimum Fixed Version |
| SE450 (ThinkEdge) | Lenovo XClarity Controller (XCC) Update (For AnyOS) | (1.60) USX324O |
| Product | Component | Minimum Fixed Version |
| P920 Rack Workstation (ThinkStation) | Lenovo XClarity Controller (XCC) for SR530,SR550,SR570,SR590,SR630,SR650,ST550,ST558,HX Series,VX Series | (8.88) CDI3A4A |
| Product | Component | Minimum Fixed Version |
| SD530 (ThinkSystem) | Lenovo XClarity Controller (XCC) Update (For AnyOS) | (3.72) TEI388S |
| SD630 V2 (ThinkSystem) | Lenovo XClarity Controller (XCC) SD630 V2, SD650 V2, SN550 V2, ST650 V2, SR670 V2, SD650-N V2 (For AnyOS) | (2.60) TGBT42H |
| SD650 DWC Dual Node Tray (ThinkSystem) | Lenovo XClarity Controller (XCC) for SD530, SD650, SN550, SN850, SR850, SR860, HX Series, VX3720, VX Series,VX Enclosure | (3.72) TEI388S |
| SD650 DWC Dual Node Tray (ThinkSystem) | Lenovo XClarity Controller (XCC) Update (For AnyOS) | (3.72) TEI388S |
| SD650 V2 (ThinkSystem) | Lenovo XClarity Controller (XCC) SD630 V2, SD650 V2, SN550 V2, ST650 V2, SR670 V2, SD650-N V2 (For AnyOS) | (2.60) TGBT42H |
| SD650-N V2 (ThinkSystem) | Lenovo XClarity Controller (XCC) SD630 V2, SD650 V2, SN550 V2, ST650 V2, SR670 V2, SD650-N V2 (For AnyOS) | (2.60) TGBT42H |
| SE350 (ThinkSystem) | Lenovo XClarity Controller (XCC) (For AnyOS) | (3.72) TEI388S |
| SE350 (ThinkSystem) | Lenovo XClarity Controller (XCC) for ThinkSystem SE350 (For AnyOS) | (3.72) TEI388S |
| SN550 (ThinkSystem) | Lenovo XClarity Controller (XCC) for SD530, SD650, SN550, SN850, SR850, SR860, HX Series, VX3720, VX Series,VX Enclosure | (3.72) TEI388S |
| SN550 (ThinkSystem) | Lenovo XClarity Controller (XCC) Update (For AnyOS) | (3.72) TEI388S |
| SN550 V2 (ThinkSystem) | Lenovo XClarity Controller (XCC) SD630 V2, SD650 V2, SN550 V2, ST650 V2, SR670 V2, SD650-N V2 (For AnyOS) | (2.60) TGBT42H |
| SN850 (ThinkSystem) | Lenovo XClarity Controller (XCC) for SD530, SD650, SN550, SN850, SR850, SR860, HX Series, VX3720, VX Series,VX Enclosure | (3.72) TEI388S |
| SN850 (ThinkSystem) | Lenovo XClarity Controller (XCC) Update (For AnyOS) | (3.72) TEI388S |
| SR150 (ThinkSystem) | Lenovo XClarity Controller (XCC) Update (For AnyOS) | (3.72) TEI388S |
| SR158 (ThinkSystem) | Lenovo XClarity Controller (XCC) Update (For AnyOS) | (3.72) TEI388S |
| SR250 (ThinkSystem) | Lenovo XClarity Controller (XCC) Update (For AnyOS) | (3.72) TEI388S |
| SR250 V2 (ThinkSystem) | Lenovo XClarity Controller (XCC) Update (For AnyOS) | (2.60) TGBT42H |
| SR258 (ThinkSystem) | Lenovo XClarity Controller (XCC) Update (For AnyOS) | (3.72) TEI388S |
| SR258 V2 (ThinkSystem) | Lenovo XClarity Controller (XCC) Update (For AnyOS) | (2.60) TGBT42H |
| SR530 (ThinkSystem) | Lenovo XClarity Controller (XCC) for SR530,SR550,SR570,SR590,SR630,SR650,ST550,ST558,HX Series,VX Series | (8.88) CDI3A4A |
| SR550 (ThinkSystem) | Lenovo XClarity Controller (XCC) for SR530,SR550,SR570,SR590,SR630,SR650,ST550,ST558,HX Series,VX Series | (8.88) CDI3A4A |
| SR570 (ThinkSystem) | Lenovo XClarity Controller (XCC) for SR530,SR550,SR570,SR590,SR630,SR650,ST550,ST558,HX Series,VX Series | (8.88) CDI3A4A |
| SR590 (ThinkSystem) | Lenovo XClarity Controller (XCC) for SR530,SR550,SR570,SR590,SR630,SR650,ST550,ST558,HX Series,VX Series | (8.88) CDI3A4A |
| SR630 (ThinkSystem) | Lenovo XClarity Controller (XCC) for SR530,SR550,SR570,SR590,SR630,SR650,ST550,ST558,HX Series,VX Series | (8.88) CDI3A4A |
| SR630 V2 (ThinkSystem) | Lenovo XClarity Controller (XCC) Update (For AnyOS) | (2.93) AFBT30P |
| SR645 (ThinkSystem) | Lenovo XClarity Controller (XCC) Update (For AnyOS) | (4.71) D8BT48P |
| SR645 V3 (ThinkSystem) | Lenovo Core Firmware Lenovo XClarity Controller (BMC) Any OS Firmware (SR645v3/SR665v3) | (4.71) D8BT48P |
| SR650 (ThinkSystem) | Lenovo XClarity Controller (XCC) for SR530,SR550,SR570,SR590,SR630,SR650,ST550,ST558,HX Series,VX Series | (8.88) CDI3A4A |
| SR650 V2 (ThinkSystem) | Lenovo XClarity Controller (XCC) Update (For AnyOS) | (2.93) AFBT30P |
| SR665 (ThinkSystem) | Lenovo XClarity Controller (XCC) Update (For AnyOS) | (4.71) D8BT48P |
| SR665 V3 (ThinkSystem) | Lenovo Core Firmware Lenovo XClarity Controller (BMC) Any OS Firmware (SR645v3/SR665v3) | (4.71) D8BT48P |
| SR670 (ThinkSystem) | Lenovo XClarity Controller (XCC) (For AnyOS) | (3.72) TEI388S |
| SR670 V2 (ThinkSystem) | Lenovo XClarity Controller (XCC) SD630 V2, SD650 V2, SN550 V2, ST650 V2, SR670 V2, SD650-N V2 (For AnyOS) | (2.60) TGBT42H |
| SR850 (ThinkSystem) | Lenovo XClarity Controller (XCC) for SD530, SD650, SN550, SN850, SR850, SR860, HX Series, VX3720, VX Series,VX Enclosure | (3.72) TEI388S |
| SR850 (ThinkSystem) | Lenovo XClarity Controller (XCC) Update (For AnyOS) | (3.72) TEI388S |
| SR850 V2 (ThinkSystem) | Lenovo XClarity Controller (XCC) SD630 V2, SD650 V2, SN550 V2, ST650 V2, SR670 V2, SD650-N V2 (For AnyOS) | (2.60) TGBT42H |
| SR850 V2 (ThinkSystem) | Lenovo XClarity Controller (XCC) SR860 V2, SR850 V2 (For AnyOS) | (2.60) TGBT42H |
| SR850P (ThinkSystem) | Lenovo XClarity Controller (XCC) (For AnyOS) | (3.72) TEI388S |
| SR860 (ThinkSystem) | Lenovo XClarity Controller (XCC) for SD530, SD650, SN550, SN850, SR850, SR860, HX Series, VX3720, VX Series,VX Enclosure | (3.72) TEI388S |
| SR860 (ThinkSystem) | Lenovo XClarity Controller (XCC) Update (For AnyOS) | (3.72) TEI388S |
| SR860 V2 (ThinkSystem) | Lenovo XClarity Controller (XCC) SD630 V2, SD650 V2, SN550 V2, ST650 V2, SR670 V2, SD650-N V2 (For AnyOS) | (2.60) TGBT42H |
| SR860 V2 (ThinkSystem) | Lenovo XClarity Controller (XCC) SR860 V2, SR850 V2 (For AnyOS) | (2.60) TGBT42H |
| SR950 (ThinkSystem) | Lenovo XClarity Controller (XCC) Update (For AnyOS) | (2.75) PSI348S |
| ST250 (ThinkSystem) | Lenovo XClarity Controller (XCC) Update (For AnyOS) | (3.72) TEI388S |
| ST250 V2 (ThinkSystem) | Lenovo XClarity Controller (XCC) Update (For AnyOS) | (2.60) TGBT42H |
| ST258 (ThinkSystem) | Lenovo XClarity Controller (XCC) Update (For AnyOS) | (3.72) TEI388S |
| ST258 V2 (ThinkSystem) | Lenovo XClarity Controller (XCC) Update (For AnyOS) | (2.60) TGBT42H |
| ST550 (ThinkSystem) | Lenovo XClarity Controller (XCC) for SR530,SR550,SR570,SR590,SR630,SR650,ST550,ST558,HX Series,VX Series | (8.88) CDI3A4A |
| ST650 V2 (ThinkSystem) | Lenovo XClarity Controller (XCC) SD630 V2, SD650 V2, SN550 V2, ST650 V2, SR670 V2, SD650-N V2 (For AnyOS) | (2.60) TGBT42H |
| ST658 V2 (ThinkSystem) | Lenovo XClarity Controller (XCC) SD630 V2, SD650 V2, SN550 V2, ST650 V2, SR670 V2, SD650-N V2 (For AnyOS) | (2.60) TGBT42H |
Was this information helpful?
Your feedback helps to improve the overall experience
Alias Id:LEN-118321
Document ID:PS500556
Original Publish Date:04/11/2023
Last Modified Date:09/21/2023
