CVE-2025-8557 Missing authorization in XClarity Orchestrator (LXCO)
A local network attacker can manipulate a device to bypass access controls and interact with internal LXCO API services, potentially accessing unauthorized data or functionality.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-8557?
CVE-2025-8557 is a high-severity missing authorization vulnerability in Lenovo XClarity Orchestrator (LXCO), published on 11 Sep 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
An internal product security audit of Lenovo XClarity Orchestrator (LXCO) discovered the below vulnerability:
An attacker with access to a device on the local Lenovo XClarity Orchestrator (LXCO) network segment may be able to manipulate the local device to create an alternate communication channel which could allow the attacker, under certain conditions, to directly interact with backend LXCO API services typically inaccessible to users. While access controls may limit the scope of interaction, this could result in unauthorized access to internal functionality or data. This issue is not exploitable from remote networks.
Weakness: CWE-420
Which versions are affected by CVE-2025-8557?
How do I fix CVE-2025-8557?
No fix has been published for CVE-2025-8557 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2025-8557 being exploited?
There is no known exploitation of CVE-2025-8557 in the wild and no public exploit code.
Sources
Also known as GHSA-rg5h-x2jj-82px.