Cpe:2.3:a:lenovo:xclarity_essentials_onecli:*:*:*:*:*:*:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3alenovoxclarity_essentials_onecli/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 12 Nov 2026 00:09:09 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgLenovo XClarity Essentials OneCLI: Command injection via remote path (CVE-2026-65952)https://feed.craftedsignal.io/briefs/2026-11-cve-2026-65952-lenovo/Thu, 12 Nov 2026 00:09:09 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-cve-2026-65952-lenovo/CVE-2026-65952 is a command injection vulnerability in the remote SSH operation functionality of Lenovo XClarity Essentials OneCLI 5.5.0 for Linux that allows execution of arbitrary OS commands with the privileges of the configured SSH account on a managed server by supplying a crafted remote path.Lenovo XClarity Essentials OneCLI 5.5.0 for Linux is affected by an improper neutralization of special elements used in an OS command within its remote SSH operation functionality.

Impact

Successful exploitation allows an attacker to execute arbitrary OS commands with the privileges of the configured SSH account on a managed server by supplying a specially crafted remote path.

Recommendation

Review documentation from Lenovo for updates regarding this issue.

]]>highadvisory