Default OpenBMC Root Credential Reintroduced After Reset to Defaults in ThinkSystem v4 XCC3
Severity and exploitation
KEV coverage does not rule out exploitation.
Assessment vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:HAssessment vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:NSeverity
high7.1CVSS measures technical severity, not the likelihood of an attack.
Known exploitation
Not listed in the checked CISA KEV catalog
Absence from CISA KEV does not rule out attacks.
Public exploit
Not established by this record
Missing evidence does not mean no public exploit exists.
Remediation
Fix status not established
No structured fix or guidance is available here. Check the latest publisher advisory.
What this means
Lenovo ThinkSystem v4 XCC3 versions IHX432Y to IHX436K have a default OpenBMC root credential vulnerability after a reset to defaults, allowing access to administrative interfaces and the underlying operating system. An attacker needs access to the XCC to exploit this. The affected versions are no longer available for download.
Summarized by @cf/meta/llama-3.3-70b-instruct-fp8-fast. Verify details against the original sources.Attack conditions
No attack-condition excerpt has been identified here. Review the full source description and references for authentication, network access, and configuration requirements.
Review supporting sources →Affected versions
Check the exact model, release, and any platform requirements against your installation.
Lenovo · lenovo
XClarity Controller
1 range
Lenovo · lenovo
XClarity Controller
Compare with this publisher’s ranges. This does not inspect your installation.
affected
IHX432Y → through IHX436K
custom versions
Other versions: unaffected
What to do
Compare your installed product and version with the affected versions above. A matching product name alone does not confirm exposure.
No structured fix or remediation guidance is available here. Check the full source description and vendor’s latest advisory for a patch or workaround; do not assume another version is safe.
cve.new guidance unless attributed to a publisher. This page does not inspect your installation.
Public exploit evidence
No public exploit reference is identified in the imported evidence. This is not a claim that no exploit exists.
Original source description
Read the full publisher description
An internal security review identified a development regression from ThinkSystem v4 XClarity Controller 3 (XCC3) versions (2.51) IHX432Y to (2.56) IHX436K which re-introduces the default OpenBMC root password upon performing an XCC Reset to Default operation. An attacker can gain access to enabled administrative interfaces of XCC using the default OpenBMC credential re-introduced after Reset to Default. Additionally, this provides access to the underlying XCC Operating System which is not normally accessible. Only these versions are affected and are no longer available for download. Process enhancements have also been made to prevent and identify potential future regression.
References
1 sourcesInside the record
Evidence available
Describes the evidence in this view, not whether the product is safe.
Original records
CVE-2026-81936View the latest unmodified CVE JSON from the official source. It may be newer than this imported page.
cve.new JSON →Contributing organizations · 1
Assigning organization
Timeline
All times UTCAdvisory published
Publication date supplied by the source.
Last imported by cve.new
Latest catalog import, not the date we first saw this advisory.
What changed
Follow changesLarge field values are marked as truncated previews. Original source snapshots remain retained.