Lenovo XClarity Controller 3 Privilege Escalation Vulnerability

Lenovo XClarity Controller 3 (XCC3) contains a security vulnerability identified as CVE-2024-23651. This flaw allows a remote, unauthenticated attacker to interact with the management controller and elevate their privileges to the administrative level. Because XClarity controllers provide low-level management capabilities for server hardware, gaining administrative access grants an attacker complete control over the host server, including the ability to modify firmware, reconfigure system settings, or intercept data flowing through the hardware. Defenders should prioritize updating affected controller firmware to mitigate the risk of unauthorized administrative access.

Impact

Successful exploitation of this vulnerability enables unauthenticated remote attackers to obtain administrative control over Lenovo server infrastructure. This impact level includes potential for persistent hardware-level compromise, exfiltration of sensitive configuration data, and full disruption of server availability. Organizations relying on Lenovo infrastructure for core business operations are at risk of significant downtime and data compromise if these systems are exposed to untrusted networks.

Recommendation

• Apply the firmware updates provided by Lenovo to address CVE-2024-23651 on all affected XClarity Controller 3 systems immediately.
• Ensure management interfaces are not exposed to the public internet and are restricted to isolated management networks accessed via hardened jump hosts.
• Audit logs for unauthorized sessions or administrative account changes originating from unexpected IP addresses targeting the XCC3 management interface.