Lenovo has recently brought attention to a significant security flaw in its ThinkSystem V4 server management firmware. This issue, identified as CVE-2026-81936, reinstitutes a default OpenBMC root password whenever a factory reset occurs, posing a risk for unauthorized access.
Details of the Security Flaw
The vulnerability, documented on November 11, 2026, allows potential attackers to gain access to administrative interfaces and delve into the underlying operating system of the controller, which is usually off-limits. Lenovo discovered this flaw during an internal security evaluation, and it affects a specific set of XClarity Controller 3 firmware versions rather than all ThinkSystem servers or products utilizing OpenBMC.
The versions impacted range from XCC3 version 2.51, build IHX432Y, to version 2.56, build IHX436K. The flaw is attributed to a development regression, where a software modification inadvertently reintroduced unsafe behavior. This flaw is triggered by performing an ‘XCC Reset to Default’ operation, which reinstates the default OpenBMC root credential.
Understanding the Impact
The vulnerability specifically arises when a controller reset to defaults is executed, with no indication that regular server restarts, OS reinstalls, or power cycles are involved. Consequently, it’s crucial to check firmware versions and reset histories to evaluate vulnerability exposure.
The XClarity Controller 3 guide notes that XCC3 is an OpenBMC-based management processor integral to ThinkSystem V4 servers, supporting hardware monitoring, firmware updates, remote power control, and several management interfaces. Access to this management layer poses a substantial risk, as it governs functions beyond typical server applications.
Responding to the Threat
Lenovo warns that once the credential is restored after a reset, attackers could exploit it to access XCC administrative interfaces, thereby gaining entry to the XCC operating system. However, this does not automatically include access to the host operating system handling business tasks.
The issue is classified under CWE-1392, indicating the use of default credentials. MITRE notes this vulnerability facilitates unauthorized access if such default values are not changed. The CVSS 4.0 and 3.1 scores of 7.1 and 6.8, respectively, highlight the severity, although both require high privileges and user interaction.
Lenovo assures that affected firmware versions are no longer available for download and states that development processes have been enhanced to prevent similar issues. No specific replacement build is mentioned, nor are there reports of active exploitation.
Administrators are advised to verify installed XCC3 builds, assess if any affected controllers have been reset, and confirm the use of supported firmware versions. Management access should remain restricted to trusted networks, and Lenovo’s security dashboard can assist in reviewing enabled services and account settings. However, firmware checks and vendor advice are essential before proceeding with further resets.
