{"id":"CVE-2026-81936","kind":"vulnerability","aliases":["CVE-2026-81936"],"related":[],"title":"Lenovo XClarity Controller: factory reset restores default OpenBMC root password","description":"An internal security review identified a development regression from ThinkSystem v4 XClarity Controller 3 (XCC3) versions (2.51) IHX432Y to (2.56) IHX436K which re-introduces the default OpenBMC root password upon performing an XCC Reset to Default operation.  An attacker can gain access to enabled administrative interfaces of XCC using the default OpenBMC credential re-introduced after Reset to Default. Additionally, this provides access to the underlying XCC Operating System which is not normally accessible. Only these versions are affected and are no longer available for download. Process enhancements have also been made to prevent and identify potential future regression.","summary":"In Lenovo ThinkSystem v4 XClarity Controller 3 firmware versions 2.51 through 2.56, a regression brings back the default OpenBMC root password after a Reset to Default. An attacker who knows that default can log in to enabled administrative interfaces and reach the underlying XCC operating system.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["bmc","infrastructure","lenovo","servers","thinksystem","xclarity-controller"],"not_affected_if":["changed-default-credentials","other-firmware-versions"],"how_to_check":"- Check the XCC firmware version on the ThinkSystem v4 server; versions `2.51` (IHX432Y) through `2.56` (IHX436K) are affected\n- Check whether the default OpenBMC root credential still works after a Reset to Default, if the team has tested or can test it on a non-production unit","fix":"- Lenovo XClarity Controller 3 firmware newer than `2.56` (affected builds are no longer available for download; the sources do not name the fixed version)","status":"open","published_at":"2026-11-11T22:17:30+00:00","first_seen_at":"2026-11-11T22:29:35+00:00","triaged_at":"2026-11-11T22:33:54+00:00","updated_at":"2026-11-11T22:33:54+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-11-11T22:33:54Z","model":"claude-haiku-5-5","output":{"fix":"- Lenovo XClarity Controller 3 firmware newer than `2.56` (affected builds are no longer available for download; the sources do not name the fixed version)","reach":"network","title":"Lenovo XClarity Controller: factory reset restores default OpenBMC root password","impact":"high","summary":"In Lenovo ThinkSystem v4 XClarity Controller 3 firmware versions 2.51 through 2.56, a regression brings back the default OpenBMC root password after a Reset to Default. An attacker who knows that default can log in to enabled administrative interfaces and reach the underlying XCC operating system.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["lenovo","xclarity-controller","thinksystem","bmc","servers"],"confidence":0.7,"fix_status":"unknown","needs_auth":"yes","worst_case":"Attacker gets administrative BMC access and the underlying XCC operating system","analyst_note":"Confirm the fixed firmware version and any Lenovo advisory text; the sources give no fixed version and no fix status beyond affected builds being withdrawn.","how_to_check":"- Check the XCC firmware version on the ThinkSystem v4 server; versions `2.51` (IHX432Y) through `2.56` (IHX436K) are affected\n- Check whether the default OpenBMC root credential still works after a Reset to Default, if the team has tested or can test it on a non-production unit","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["other-firmware-versions","changed-default-credentials"],"who_is_affected":"Teams running Lenovo ThinkSystem v4 servers with XClarity Controller 3 firmware between 2.51 (IHX432Y) and 2.56 (IHX436K). Exposure appears after a Reset to Default, which re-applies the default OpenBMC root password; servers on other firmware or with changed credentials are not described as affected.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000819,"input_tokens":4667,"output_tokens":704,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-81936':13A,16A '2.51':34B,87C '2.56':36B,90C '3':31B,84C 'access':113C,135C,146C 'addit':132C 'administr':62B,116C 'affect':151C 'also':162C 'attack':52B,110C 'avail':156C 'back':40B 'bmc':17B 'bring':39B 'control':3A,24B,30B,83C 'credenti':124C 'cve':11A,14A 'default':7A,42B,50B,56B,97C,107C,122C,131C 'develop':77C 'download':158C 'enabl':61B,115C 'enhanc':160C 'factori':4A 'firmwar':32B 'futur':170C 'gain':112C 'identifi':75C,168C 'ihx432y':88C 'ihx436k':91C 'infrastructur':18B 'interfac':63B,117C 'intern':72C 'introduc':95C,127C 'know':54B 'lenovo':1A,19B,26B 'log':58B 'longer':155C 'made':164C 'normal':145C 'openbmc':8A,43B,98C,123C 'oper':69B,108C,140C 'password':10A,45B,100C 'perform':102C 'potenti':169C 'prevent':166C 'process':159C 'provid':134C 're':94C,126C 're-introduc':93C,125C 'reach':65B 'regress':38B,78C,171C 'reset':5A,48B,105C,129C 'restor':6A 'review':74C 'root':9A,44B,99C 'secur':73C 'server':20B 'system':70B,141C 'thinksystem':21B,27B,80C 'under':67B,138C 'upon':101C 'use':120C 'v4':28B,81C 'version':33B,86C,149C 'xcc':68B,104C,119C,139C 'xcc3':85C 'xclariti':2A,23B,29B,82C 'xclarity-control':22B","nicknames":[],"mitigations":[],"who_affected":"Teams running Lenovo ThinkSystem v4 servers with XClarity Controller 3 firmware between 2.51 (IHX432Y) and 2.56 (IHX436K). Exposure appears after a Reset to Default, which re-applies the default OpenBMC root password; servers on other firmware or with changed credentials are not described as affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["bmc","high","infrastructure","lenovo","servers","thinksystem","xclaritycontroller"],"campaign_type":null,"search_a":"'-2026':12A,15A '-81936':13A,16A 'control':3A 'cve':11A,14A 'default':7A 'factori':4A 'lenovo':1A 'openbmc':8A 'password':10A 'reset':5A 'restor':6A 'root':9A 'xclariti':2A","search_b":"'2.51':34B '2.56':36B '3':31B 'administr':62B 'attack':52B 'back':40B 'bmc':17B 'bring':39B 'control':24B,30B 'default':42B,50B,56B 'enabl':61B 'firmwar':32B 'infrastructur':18B 'interfac':63B 'know':54B 'lenovo':19B,26B 'log':58B 'openbmc':43B 'oper':69B 'password':45B 'reach':65B 'regress':38B 'reset':48B 'root':44B 'server':20B 'system':70B 'thinksystem':21B,27B 'under':67B 'v4':28B 'version':33B 'xcc':68B 'xclariti':23B,29B 'xclarity-control':22B","search_c":"'2.51':87C '2.56':90C '3':84C 'access':113C,135C,146C 'addit':132C 'administr':116C 'affect':151C 'also':162C 'attack':110C 'avail':156C 'control':83C 'credenti':124C 'default':97C,107C,122C,131C 'develop':77C 'download':158C 'enabl':115C 'enhanc':160C 'futur':170C 'gain':112C 'identifi':75C,168C 'ihx432y':88C 'ihx436k':91C 'interfac':117C 'intern':72C 'introduc':95C,127C 'longer':155C 'made':164C 'normal':145C 'openbmc':98C,123C 'oper':108C,140C 'password':100C 'perform':102C 'potenti':169C 'prevent':166C 'process':159C 'provid':134C 're':94C,126C 're-introduc':93C,125C 'regress':78C,171C 'reset':105C,129C 'review':74C 'root':99C 'secur':73C 'system':141C 'thinksystem':80C 'under':138C 'upon':101C 'use':120C 'v4':81C 'version':86C,149C 'xcc':104C,119C,139C 'xcc3':85C 'xclariti':82C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T22:17:30+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"psirt@lenovo.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-81936","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-81936","severity":null,"published_at":"2026-11-11T22:17:30+00:00","modified_at":"2026-11-11T22:17:30+00:00","first_seen_at":"2026-11-11T22:29:35+00:00","fetched_at":"2026-11-11T22:29:35+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}