Lenovo XClarity Administrator (LXCA) Local Elevation of Privilege vulnerability

Fault symptom:

Lenovo security announcement: LEN-7145

Potential impact: Local permission improvement

Severity: high

Impact scope: Lenovo

Abstract description:

During internal testing, Lenovo discovered a local excessive permission vulnerability in some LXCA versions. By exploiting this vulnerability, local users without administrative permissions can create a management account.

Lenovo XClarity Administrator (LXCA) is a centralized resource management solution that simplifies infrastructure management, increases response speeds, and enhances the availability of Lenovo server systems and solutions.

Solution:

Measures should be taken for self-protection:

Download the file from the following link and follow the instructions in the upgrade README file to update LXCA to version 1.1.1 or later.

Product impact:

LXCA versions earlier than 1.1.1