XClarity OneCLI EUVD-2026-52884

Exploitation requires all of the following conditions to hold simultaneously: (1) A low-privilege local OS user must have an interactive shell on the same Linux host running OneCLI. (2) A privileged user (e.g., root or a sudoer) must actively execute OneCLI during the attack window - the vulnerability does not exist in the absence of a concurrent elevated execution. (3) The attacker must successfully win a race condition timing window (AT:P) to substitute a symlink before OneCLI writes its temporary file. Exploitation is limited by: local-only attack surface (no remote vector), mandatory concurrency of a privileged OneCLI execution, race condition complexity, no confidentiality impact (cannot read data), and restriction to Linux only. Default single-user or administrator-only server deployments are not at meaningful risk.

Real-world risk is low. The CVSS 4.0 score of 1.0 reflects multiple compounding mitigations: AV:L (requires local shell access to the host), AT:P (attack timing dependency - the attacker must win a race condition), PR:L (authenticated low-privilege OS user required), and UI:P (a privileged user must simultaneously run OneCLI). All four conditions must align. Impact is bounded: VI:L and VA:L with no confidentiality impact, meaning the attacker cannot read sensitive data - only corrupt or truncate files writable by the elevated OneCLI process. EPSS data is not available in the provided intelligence, and the vulnerability is not in CISA KEV. No POC has been identified. The primary population at risk is multi-user Lenovo server management hosts where low-trust accounts coexist with administrators who run OneCLI elevated - a narrow deployment pattern. This is a compliance and hardening issue rather than a critical incident-response priority.

An attacker with a low-privilege shell account on a shared Lenovo server management host monitors /tmp for characteristic temporary files created by OneCLI. When a sysadmin invokes OneCLI with sudo for a routine firmware inventory task, the attacker races to replace the temp file with a symlink to /etc/cron.d/cleanup or another root-writable file. OneCLI, executing as root, then overwrites the symlink target with program-generated data, truncating or corrupting the file. No public POC exists, and the race condition (AT:P) adds meaningful exploitation friction.