EUVD-2026-52884
GHSA-frpq-fxq8-73pm
Severity by source
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local vector only; race condition maps to AC:H in 3.1; privileged user must run OneCLI concurrently (UI:R); no confidentiality impact.
Primary rating from Vendor (lenovo).
CVSS VectorVendor: lenovo
Lifecycle Timeline
2DescriptionCVE.org
A temporary file creation vulnerability in the Linux version of Lenovo XClarity Essentials OneCLI 5.5.0 and below could allow a local low-privileged attacker to overwrite or truncate arbitrary local files with program-generated data when OneCLI is executed with elevated privileges.
AnalysisAI
Insecure temporary file creation in Lenovo XClarity Essentials OneCLI 5.5.0 and earlier on Linux enables a local low-privileged attacker to overwrite or truncate arbitrary system files via a race condition (CWE-377), but only when a privileged user concurrently executes OneCLI with elevated rights. The attack timing requirement (AT:P in the vendor CVSS 4.0 vector) confirms this is a classic TOCTOU-style symlink race, limiting realistic exploitation to shared multi-user Linux environments where an administrator routinely runs the tool elevated. No public exploit code or CISA KEV listing exists; the vendor has released a patch via advisory LEN-ht116433.
Technical ContextAI
CWE-377 (Improper Creation of Temporary File) describes a class of vulnerability where an application creates a predictable or world-accessible temporary file in a directory such as /tmp, allowing an attacker to pre-create or swap a symlink targeting a sensitive file before the privileged process writes to it. Lenovo XClarity Essentials OneCLI is a Linux command-line utility used by systems administrators to manage Lenovo server hardware (ThinkSystem, System x, etc.), typically invoked via sudo or as root for inventory, firmware update, and configuration tasks. The affected CPE cpe:2.3:a:lenovo:xclarity_essentials_onecli:*:*:*:*:*:*:*:* covers all versions through 5.5.0 on Linux. When OneCLI runs elevated, its insecure temp file usage can be exploited by any co-resident low-privilege OS user to cause arbitrary file truncation or overwrite with tool-generated content, potentially corrupting configuration files, logs, or other assets writable by root.
RemediationAI
Upgrade Lenovo XClarity Essentials OneCLI to the patched version identified in Lenovo advisory ht116433 at https://support.lenovo.com/us/en/solutions/ht116433. The vendor confirms a patch is available, though the exact fixed version number is not stated in the available intelligence - consult the advisory directly to confirm the target release. As a compensating control where immediate patching is not possible, restrict shell access to OneCLI hosts to only administrators who require it, eliminating the low-privilege co-resident user precondition. Additionally, consider running OneCLI from a dedicated privileged account on isolated jump hosts rather than shared multi-user systems. Using a private secure temp directory (e.g., via a wrapper that sets TMPDIR to a root-owned path before invoking OneCLI) can also defeat symlink attacks if patching is delayed, though this requires scripting discipline and carries a risk of breaking OneCLI behavior if the tool hardcodes temp paths.
Same weakness CWE-377 – Insecure Temporary File
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today