Newshot Article title: Lenovo Discloses High-Severity Vulnerability in ThinkSystem Servers That Restores Default Root Credentials After Reset
Body:
Lenovo has released a security advisory disclosing a high-severity vulnerability in ThinkSystem V4 server management firmware. After a device performs a factory reset operation, the default root password of OpenBMC is restored.
Specific versions of XCC3 firmware are affected, and only default reset triggers the vulnerability
The vulnerability is tracked as CVE-2026-81936. An attacker could exploit it to access an enabled management interface and enter the underlying operating system to which the controller normally strictly restricts access. The corresponding CVE record was published on November 11, 2026, and Lenovo discovered the issue during an internal security audit. The vulnerability affects only a specific version range of XClarity Controller 3 (hereinafter referred to as XCC3) firmware; not all ThinkSystem servers, or all products using OpenBMC, are at risk.
The affected firmware version range is XCC3 version 2.51 (build number IHX432Y) through version 2.56 (build number IHX436K). Lenovo said the cause of the vulnerability is a development regression, in which a code change reintroduced insecure logic. Performing the "XCC Reset to Default" operation in the above versions re-enables the default root credentials of OpenBMC.
The trigger conditions for the vulnerability are very clear: it is triggered only when the controller is restored to default settings. Ordinary server restarts, operating system reinstallations, and power cycling operations will not cause the issue. Therefore, when assessing the affected scope, checking the firmware version and confirming the device reset history are crucial.
According to Lenovo's XCC3 product guide, XCC3 is the built-in management processor of ThinkSystem V4 servers and is developed based on OpenBMC. It supports hardware monitoring, firmware updates, remote power control, and other functions, and exposes multiple management interfaces externally. The risk of accessing this control layer is extremely high because its control scope goes beyond ordinary business applications running on the server.
The vulnerability can lead to compromise of the controller, and exploitation requires preconditions
After a device reset restores the default credentials, an attacker can use those credentials to log in to an enabled XCC management interface. Lenovo specifically notes that obtaining the credentials can provide access to the underlying operating system of XCC. This system is the controller's own operating system and is not directly equivalent to the host operating system running business workloads.
The vulnerability is a CWE-1392 (Use of Default Credentials) type flaw. MITRE defines this type of flaw as the use of default passwords or keys for critical functions; if administrators do not change the default configuration, unauthorized access becomes much easier.
The vulnerability has a CVSS 4.0 score of 7.1, which is high severity; its CVSS 3.1 score is 6.8, which is medium severity. The exploitation path in both scoring versions requires the attacker to have high privileges and requires user interaction to trigger. This means an attacker cannot use this vulnerability alone to achieve remote unauthorized access or directly take over the device, and there is no Internet-wide generic exploitation risk.
Previously disclosed OpenBMC server vulnerabilities and BMC firmware security incidents have already shown that security at the controller layer requires separate, focused protection. It should be noted that past incidents involved other vulnerabilities, and there is currently no evidence that Lenovo's vulnerability this time has been exploited in the wild.
Lenovo has withdrawn the affected firmware, and administrators need to check risks item by item
Lenovo said it has currently withdrawn all affected firmware versions and has also improved its development process to avoid similar regressions from occurring again through both prevention and detection. This advisory does not specify a specific fixed version build number, nor has any report been received of active attacks exploiting the vulnerability.
Administrators should first check the XCC3 firmware build version currently installed on devices, verify whether controllers within the affected range have undergone a reset operation, and contact Lenovo to confirm the applicable officially supported firmware version. In addition, access control policies need to be strictly configured to limit access to management interfaces to trusted networks.
Lenovo's security control panel can help administrators check enabled services and account configurations, but this tool cannot replace firmware version range verification. Before performing subsequent reset operations, administrators must first obtain official guidance from the vendor and must not rely solely on the panel's check results.
Lenovo Warns of High-Severity Server Flaw That Restores Default Root Credentials After Reset