关键漏洞信息 Lenovo Security Advisory: LEN-201014 Potential Impact: Unauthorized Access Severity: High Scope of Impact: Lenovo-specific CVE Identifier: CVE-2025-8557 Summary Description An internal product security audit of Lenovo XClarity Orchestrator (LXCO) discovered the following vulnerability: An attacker with access to a device on the local Lenovo XClarity Orchestrator (LXCO) network segment may be able to manipulate the local device to create an alternate communication channel which could allow the attacker, under certain conditions, to directly interact with backend LXCO API services typically inaccessible to users. While access controls may limit the scope of interaction, this could result in unauthorized access to internal functionality or data. This issue is not exploitable from remote networks. Mitigation Strategy for Customers Update to the version (or newer) indicated in the Product Impact section below. Product Impact Product: Lenovo XClarity Orchestrator Component: Lenovo XClarity Orchestrator (LXCO) Minimum Fixed Version: 2.2.0 Revision History Affected Products Software: Lenovo XClarity Orchestrator