A high-severity OS command injection vulnerability in Lenovo XClarity Orchestrator allows authenticated attackers to execute arbitrary commands on the underlying system.

The application improperly neutralizes special characters in user input, which are then passed to the underlying operating system. This allows an authenticated attacker to inject and execute arbitrary OS commands with the privileges of the application.

With a CVSS score of 8.8, this vulnerability poses a significant risk to the confidentiality, integrity, and availability of the host system. Successful exploitation could lead to full system takeover, enabling attackers to move laterally within the network or exfiltrate sensitive management data.

Immediate Action: Update Lenovo XClarity Orchestrator to version 2.2.0 or higher as specified in the official Lenovo security advisory.

Proactive Monitoring: Monitor system logs for suspicious process execution or unexpected command-line activity originating from the LXCO service account.

Compensating Controls: Implement a Web Application Firewall (WAF) to inspect and block malicious input patterns that attempt to inject OS commands.

Public Exploit Available: Unknown.

The risk of unauthorized system-level code execution necessitates immediate patching of all instances of Lenovo XClarity Orchestrator. Administrators must prioritize this update to ensure the security of their infrastructure management environment.