Lenovo has revealed a serious flaw in its ThinkSystem V4 server management firmware. A defect in certain XClarity Controller 3 (XCC3) firmware versions causes the default OpenBMC root password to be re-enabled whenever the controller undergoes a factory reset. The vulnerability is tracked as CVE-2026-81936, and is classified as high severity.
Which Servers and Versions Are Affected?
The flaw impacts ThinkSystem V4 servers running specific XCC3 firmware builds—from version 2.51 build IHX432Y up to version 2.56 build IHX436K. It was introduced through a development regression, where a recent change reintroduced the unsafe behavior where resetting to defaults causes the default OpenBMC root credential to return. Regular restarts, OS reinstalls, or power cycles do not trigger this issue.
Risk Profile & Mitigation Steps
An attacker who knows or discovers this default credential and has access to enabled administrative interfaces can gain control over the controller’s operating system—not the server’s main OS—but still a serious foothold. The issue is cataloged under the Common Weakness Enumeration (CWE-1392) for use of default credentials. According to Lenovo’s report, the CVSS 4.0 score is 7.1 (high), while the older CVSS 3.1 score is 6.8 (medium). All of them require high privileges and user interaction.
Lenovo has removed the affected firmware versions from its download site and claims it has improved internal development processes to prevent similar regressions going forward. Administrators are urged to inventory their XCC3 firmware versions, determine whether any controllers with vulnerable firmware were reset, and verify which builds are supported. They should also limit management interface exposure, restricting access to trusted networks, and ensure that services and account settings reported in Lenovo’s security dashboard are correct before performing any further resets.
There are no reports yet of active exploitation of this flaw. The disclosure comes from an internal security review by Lenovo.
Why this matters: This incident highlights how firmware is often a weak link in server security. OpenBMC-based controllers like XCC3 are powerful unseen components that manage critical hardware functions. A default-credential backdoor in such systems can lead to serious breaches if left undiscovered.
