Local Network Vulnerability in Lenovo XClarity Orchestrator Product

CVE-2025-8557

What is CVE-2025-8557?

An internal security audit of Lenovo XClarity Orchestrator revealed a vulnerability that could allow an attacker with local network access to manipulate a device. By creating an alternate communication channel, the attacker may directly interact with backend API services that are normally protected from user access. Although access controls may impose limitations, this vulnerability poses significant risks, including unauthorized access to sensitive internal functionalities or data. The issue is non-exploitable from external networks.

References