Cleartext transmission of sensitive information in Lenovo XClarity Controller
Priority LOW 23CWE-319Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-319.
Summary
An internal product security audit of Lenovo XClarity Controller (XCC) discovered that the XCC configuration backup/restore password may be written to an internal XCC log buffer if Lenovo XClarity Administrator (LXCA) is used to perform the backup/restore. The backup/restore password typically exists in this internal log buffer for less than 10 minutes before being overwritten. Generating an FFDC service log will include the log buffer contents, including the backup/restore password if present. The FFDC service log is only generated when requested by a privileged XCC user and it is only accessible to the privileged XCC user that requested the file. The backup/restore password is not captured if the backup/restore is initiated directly from XCC.
Why it matters now
EPSS 0.00495 42nd percentileScored 2026-11-07
Fix Fixed XClarity Controller (XCC) (Lenovo): 6.00 CDI370Q, 1.10 TGBT12Q, 3.20 TEI378W +2
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Lenovo | XClarity Controller (XCC) | before 6.00 CDI370Q; before 1.10 TGBT12Q; before 3.20 TEI378W; before 2.14 PSI338I; before 4.40 TEI3B2P | 6.00 CDI370Q, 1.10 TGBT12Q, 3.20 TEI378W, 2.14 PSI338I, 4.40 TEI3B2P | Patch available | CNA |
- XClarity Controller (XCC) VendorLenovo Affected before 6.00 CDI370Q; before 1.10 TGBT12Q; before 3.20 TEI378W; before 2.14 PSI338I; before 4.40 TEI3B2P Fixed in 6.00 CDI370Q, 1.10 TGBT12Q, 3.20 TEI378W, 2.14 PSI338I, 4.40 TEI3B2P Patch available CNA
CPE configurations NVD · 41
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:lenovo:xclarity_controller:6.00_cdi370q:*:*:*:*:*:*:* | 6.00_cdi370q | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:thinkagile_hx1320:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:h:lenovo:thinkagile_hx2320:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:h:lenovo:thinkagile_hx3320:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:h:lenovo:thinkagile_hx3375:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:h:lenovo:thinkagile_hx3520-g:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:h:lenovo:thinkagile_hx3720:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:h:lenovo:thinkagile_hx5520:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:h:lenovo:thinkagile_hx7520:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:h:lenovo:thinkagile_hx7820:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
- cpe:2.3:a:lenovo:xclarity_controller:6.00_cdi370q:*:*:*:*:*:*:* Versions 6.00_cdi370q Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:thinkagile_hx1320:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:h:lenovo:thinkagile_hx2320:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:h:lenovo:thinkagile_hx3320:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:h:lenovo:thinkagile_hx3375:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:h:lenovo:thinkagile_hx3520-g:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:h:lenovo:thinkagile_hx3720:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:h:lenovo:thinkagile_hx5520:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:h:lenovo:thinkagile_hx7520:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:h:lenovo:thinkagile_hx7820:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
Show 31 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:h:lenovo:thinkagile_mx_certified_nodes:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:h:lenovo:thinkagile_vx_1u:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:h:lenovo:thinkagile_vx_2u:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:h:lenovo:thinkagile_vx_dense:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:h:lenovo:thinksystem_sr530:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:h:lenovo:thinksystem_sr570:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:h:lenovo:thinksystem_sr590:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:h:lenovo:thinksystem_sr630:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:h:lenovo:thinksystem_sr650:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:h:lenovo:thinksystem_st550:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:h:lenovo:thinksystem_st558:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:a:lenovo:xclarity_controller:1.10_tgbt12q:*:*:*:*:*:*:* | 1.10_tgbt12q | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:thinkagile_mx1020:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:h:lenovo:thinksystem_se350:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:h:lenovo:thinksystem_sr670:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:h:lenovo:thinksystem_sr850p:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:a:lenovo:xclarity_controller:2.14_psi338i:*:*:*:*:*:*:* | 2.14_psi338i | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:thinksystem_sr950:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:a:lenovo:xclarity_controller:4.40_tei3b2p:*:*:*:*:*:*:* | 4.40_tei3b2p | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:thinksystem_sd530:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:h:lenovo:thinksystem_sd650:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:h:lenovo:thinksystem_sn550:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:h:lenovo:thinksystem_sn850:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:h:lenovo:thinksystem_sr150:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:h:lenovo:thinksystem_sr158:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:h:lenovo:thinksystem_sr250:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:h:lenovo:thinksystem_sr258:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:h:lenovo:thinksystem_sr850:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:h:lenovo:thinksystem_sr860:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:h:lenovo:thinksystem_st250:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:h:lenovo:thinksystem_st258:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
- cpe:2.3:h:lenovo:thinkagile_mx_certified_nodes:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:h:lenovo:thinkagile_vx_1u:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:h:lenovo:thinkagile_vx_2u:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:h:lenovo:thinkagile_vx_dense:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:h:lenovo:thinksystem_sr530:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:h:lenovo:thinksystem_sr570:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:h:lenovo:thinksystem_sr590:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:h:lenovo:thinksystem_sr630:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:h:lenovo:thinksystem_sr650:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:h:lenovo:thinksystem_st550:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:h:lenovo:thinksystem_st558:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:a:lenovo:xclarity_controller:1.10_tgbt12q:*:*:*:*:*:*:* Versions 1.10_tgbt12q Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:thinkagile_mx1020:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:h:lenovo:thinksystem_se350:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:h:lenovo:thinksystem_sr670:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:h:lenovo:thinksystem_sr850p:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:a:lenovo:xclarity_controller:2.14_psi338i:*:*:*:*:*:*:* Versions 2.14_psi338i Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:thinksystem_sr950:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:a:lenovo:xclarity_controller:4.40_tei3b2p:*:*:*:*:*:*:* Versions 4.40_tei3b2p Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:thinksystem_sd530:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:h:lenovo:thinksystem_sd650:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:h:lenovo:thinksystem_sn550:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:h:lenovo:thinksystem_sn850:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:h:lenovo:thinksystem_sr150:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:h:lenovo:thinksystem_sr158:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:h:lenovo:thinksystem_sr250:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:h:lenovo:thinksystem_sr258:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:h:lenovo:thinksystem_sr850:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:h:lenovo:thinksystem_sr860:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:h:lenovo:thinksystem_st250:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:h:lenovo:thinksystem_st258:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
Remediation
- Fix · CNA XClarity Controller (XCC) (Lenovo) Fixed in 6.00 CDI370Q, 1.10 TGBT12Q, 3.20 TEI378W, 2.14 PSI338I, 4.40 TEI3B2P
Timeline
- 2026-10-02 Threatist record created from CVE-2021-3473
- 2026-10-03 Alias added: GHSA-jcrf-qjqf-vj89
References
More Lenovo Xclarity Controller vulnerabilities
- TI-2019-04386 CSV injection in Lenovo XClarity Controller CVSS 3.1MEDIUM 6.5
- TI-2021-02853 Incorrect authorization in Lenovo XClarity Controller CVSS 3.1MEDIUM 5.3
- TI-2019-04394 Access control flaw in Lenovo XClarity Controller CVSS 3.1MEDIUM 4.8
Sources
- CVE-2021-3473 · CVE Program
- CVE-2021-3473 · NVD
- FIRST EPSS
- GHSA-jcrf-qjqf-vj89 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences