Lenovo Server Flaw Restores Default Root Credentials After Reset

Lenovo has disclosed a high-severity security flaw impacting its ThinkSystem V4 server management firmware, specifically within the XClarity Controller 3 (XCC3) component. The vulnerability, tracked as CVE-2026-81936, allows default OpenBMC root credentials to be restored following a factory reset operation. This could potentially enable attackers to gain unauthorized access to administrative interfaces and, in some cases, the controller's underlying operating system.

The issue affects a specific range of XCC3 firmware versions, from 2.51 (build IHX432Y) through 2.56 (build IHX436K). Lenovo identified the flaw internally and attributes it to a development regression, indicating that a recent software change inadvertently reintroduced this insecure behavior. Crucially, the vulnerability is triggered only by an explicit "XCC Reset to Default" operation, and not by ordinary server restarts or power cycles.

XClarity Controller 3, built on OpenBMC, is integrated into ThinkSystem V4 servers and provides essential management functions such as hardware monitoring, firmware updates, and remote power control. Access to this management layer is critical for server administration but also presents a significant security risk if compromised, as it operates at a privileged level.

Upon restoration of the default credential, an attacker could leverage it to access enabled XCC administrative interfaces. Lenovo's advisory also notes the potential for access to the underlying XCC operating system, which is distinct from the host operating system running user applications and workloads. The vulnerability is categorized under CWE-1392, Use of Default Credentials, highlighting the inherent risk of predictable or unchanged default passwords.

The Common Vulnerability Scoring System (CVSS) assigns a score of 7.1 (High) under version 4.0 and 6.8 (Medium) under version 3.1. Both scoring vectors indicate that exploitation typically requires elevated privileges and user interaction, suggesting it is not a simple, unauthenticated remote takeover scenario.

Lenovo has since removed the affected firmware versions from public download and stated that development processes have been enhanced to prevent similar regressions. The company has not reported any active exploitation of this vulnerability. Administrators are advised to verify their installed XCC3 firmware versions, assess whether affected controllers have undergone factory resets, and consult Lenovo's official guidance for recommended actions and supported firmware updates.

Maintaining strict access controls for management interfaces, restricting access to trusted networks, and regularly reviewing security configurations are essential mitigation steps. While XClarity Controller 3 offers security features, proactive verification of firmware integrity and adherence to vendor recommendations remain paramount for safeguarding server infrastructure.