CVE-2025-8557

Katalog CVE

CVSS 8.8 · High EPSS 0,25%

Kerentanan Unprotected Alternate Channel. Skor CVSS 3.1 8.8 (High) menurut lenovo.com.

Deskripsi (NVD)

An internal product security audit of Lenovo XClarity Orchestrator (LXCO) discovered the below vulnerability: An attacker with access to a device on the local Lenovo XClarity Orchestrator (LXCO) network segment may be able to manipulate the local device to create an alternate communication channel which could allow the attacker, under certain conditions, to directly interact with backend LXCO API services typically inaccessible to users. While access controls may limit the scope of interaction, this could result in unauthorized access to internal functionality or data. This issue is not exploitable from remote networks.

Rincian

Terbit di NVD

11 September 2025

Terakhir diubah

17 Juni 2026

Status NVD

Deferred

CVSS 3.1

8.8 (High), sumber lenovo.com
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-420: Unprotected Alternate Channel

EPSS (30 hari)

0,25% peluang dieksploitasi; lebih tinggi dari 15,6% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://support.lenovo.com/us/en/product_security/LEN-201014