[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fwHmFQitgVYNkI2CFqyArgG0HtE9e8tgJ5zJyfUuRJfs":3},{"article":4,"iocs":46,"watch_terms":51,"solutions":52,"lesson":133},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":28,"category":29,"article_tags":33},"8b41a31b-af03-482b-a25e-847f080b9662","Lenovo Warns of High-Severity Server Flaw That Restores Default Root Credentials After Reset","lenovo-warns-of-high-severity-server-flaw-that-restores-default-root-credentials-02bd0c","Lenovo has disclosed a high-severity security flaw in ThinkSystem V4 server management firmware that restores a default OpenBMC root password after a factory reset. Tracked as CVE-2026-81936, the issue could let attackers access enabled administrative interfaces and reach the controller’s underlying operating system, which is normally restricted. The CVE record, published on November 11, 2026, […] The post Lenovo Warns of High-Severity Server Flaw That Restores Default Root Credentials After Reset appeared first on Cyber Security News.","Lenovo has disclosed a high-severity security flaw in ThinkSystem V4 server management firmware (CVE-2026-81936) where a factory reset restores a default OpenBMC root password. This vulnerability, affecting specific XClarity Controller 3 firmware versions, could allow attackers to access administrative interfaces and the controller's operating system. Lenovo states the issue was a development regression and has since improved its development processes, with affected versions no longer available for download.","Lenovo ThinkSystem V4 servers have a high-severity flaw that restores default root credentials after a reset.","https:\u002F\u002Fcybersecuritynews.com\u002Flenovo-server-flaw\u002F","https:\u002F\u002Fcybersecuritynews.com\u002Fwp-content\u002Fuploads\u002F2026\u002F11\u002FLenovo-Warns-of-High-Severity-Server-Vulnerability-That-Restores-Default-Root-Credentials-After-Factory-Reset.webp","2026-11-12T13:37:44+00:00","2026-11-12T14:00:25.537858+00:00",8,[17,20,22,25],{"name":18,"type":19},"ThinkSystem V4","product",{"name":21,"type":19},"XClarity Controller 3",{"name":23,"type":24},"OpenBMC","technology",{"name":26,"type":27},"Lenovo","vendor","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":28,"icon":30,"name":31,"slug":32},null,"Vulnerabilities","vulnerabilities",[34,36,41],{"category":35},{"id":28,"icon":30,"name":31,"slug":32},{"category":37},{"id":38,"icon":30,"name":39,"slug":40},"d6f63bb8-0801-486a-be7f-171400700454","IoT\u002FOT","iot-ot",{"category":42},{"id":43,"icon":30,"name":44,"slug":45},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[47],{"type":48,"value":49,"context":50},"cve","CVE-2026-81936","Lenovo ThinkSystem V4 server management firmware vulnerability",[26,18,21],{"controls":53,"vendors":132},[54,83,111],{"slug":55,"name":56,"problem":57,"products":58},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[59,67,75],{"vendor_slug":60,"vendor_name":61,"vendor_logo":62,"product_slug":63,"product_name":64,"url":65,"description":66},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"vendor_slug":68,"vendor_name":69,"vendor_logo":70,"product_slug":71,"product_name":72,"url":73,"description":74},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"vendor_slug":76,"vendor_name":77,"vendor_logo":78,"product_slug":79,"product_name":80,"url":81,"description":82},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"slug":84,"name":85,"problem":86,"products":87},"patch-management","Automated patch management","Known holes get closed in days, not months.",[88,96,103],{"vendor_slug":89,"vendor_name":90,"vendor_logo":91,"product_slug":92,"product_name":93,"url":94,"description":95},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",{"vendor_slug":97,"vendor_name":98,"vendor_logo":99,"product_slug":84,"product_name":100,"url":101,"description":102},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"vendor_slug":104,"vendor_name":105,"vendor_logo":106,"product_slug":107,"product_name":108,"url":109,"description":110},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"slug":112,"name":113,"problem":114,"products":115},"endpoint-management","Device management (MDM and UEM)","Every company laptop and phone is known, encrypted, locked down and up to date.",[116,124],{"vendor_slug":117,"vendor_name":118,"vendor_logo":119,"product_slug":120,"product_name":121,"url":122,"description":123},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":125,"vendor_name":126,"vendor_logo":127,"product_slug":128,"product_name":129,"url":130,"description":131},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",[],{"slug":134,"title":135,"body":136,"framework_refs":137,"framework_notes":143},"factory-reset-restores-default-root-credentials-in-lenovo-server-firmware","Factory Reset Restores Default Root Credentials in Lenovo Server Firmware","A development regression in Lenovo's ThinkSystem V4 XClarity Controller 3 firmware caused factory resets to silently restore a known default root password for the OpenBMC management interface, effectively undoing any credential hardening administrators had applied. This is especially dangerous because factory resets are often performed during troubleshooting or hardware redeployment — moments when security posture is already in flux. An attacker with network access to the BMC interface could exploit the restored default credentials to gain full administrative control over the server's out-of-band management system. The incident underscores that secure-by-default configuration must be rigorously validated across the entire firmware lifecycle, including reset and recovery paths, not just initial provisioning.",[138,139,140,141,142],"CIS Control 4: Secure Configuration of Enterprise Assets and Software (v8)","NIST SP 800-53 CM-6: Configuration Settings","NIST SP 800-53 IA-5: Authenticator Management","NIS2 Article 21(2)(e)","NIST CSF 2.0 PR.AA-01: Identity management, authentication, and access control",{"NIS2 Article 21(2)(e)":144,"NIST SP 800-53 CM-6: Configuration Settings":145,"NIST SP 800-53 IA-5: Authenticator Management":146,"CIS Control 4: Secure Configuration of Enterprise Assets and Software (v8)":147,"NIST CSF 2.0 PR.AA-01: Identity management, authentication, and access control":148},"This point covers security in acquisition, development and maintenance including vulnerability handling — the regression introduced during development and the need for secure coding and testing practices in firmware directly reflects this requirement.","CM-6 requires that security configuration settings be established and enforced, including ensuring that resets or recovery operations do not revert systems to insecure default states.","IA-5 governs the lifecycle management of authenticators and explicitly prohibits the use of default passwords, which this firmware regression re-introduced upon factory reset.","CIS Control 4 requires that default credentials be changed and secure configurations be maintained — this incident shows a reset silently reverting to insecure defaults, violating that principle.","This category requires that credentials and authentication mechanisms be managed securely throughout the system lifecycle, which a reset-induced credential reversion directly undermines."]