PT-2025-37260 · Lenovo · Lenovo Xclarity Orchestrator

Published 2025-09-09 · Updated 2025-09-11 · CVE-2025-8557

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Lenovo XClarity Orchestrator (LXCO) (affected versions not specified)

Description: An attacker with access to a device on the local network segment may be able to manipulate the device to create an alternate communication channel. This could allow the attacker to directly interact with backend LXCO API services typically inaccessible to users. While access controls may limit the scope of interaction, this could result in unauthorized access to internal functionality or data. This issue is not exploitable from remote networks.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-420

Related Identifiers

BDU:2026-00015

CVE-2025-8557

Affected Products

Lenovo Xclarity Orchestrator

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-8557 · Security Note
• https://bdu.fstec.ru/vul/2026-00015 · Security Note
• https://twitter.com/CveFindCom/status/1966209994413506713 · Twitter Post
• https://support.lenovo.com/us/en/product_security/LEN-201014 · Note
• https://twitter.com/CVEnew/status/1966225704259137902 · Twitter Post
• https://support.lenovo.com/us/en/productsecurity/LEN-201014 · Note