Is CVE-2025-8557 actively exploited?

No active exploitation of CVE-2025-8557 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2025-8557 be exploited remotely?

Partially. CVE-2025-8557 requires adjacent network access (same network segment) to exploit.

What is the CVSS score of CVE-2025-8557?

CVE-2025-8557 has a CVSS score of 8.8 (HIGH).

HOME VULNERABILITIESCVE-2025-8557

HIGH

CVE-2025-8557

CWE-420Published: September 11, 2025· Updated: Jun 17, 2026

8.8

CVSS v3.1

Official Description

An internal product security audit of Lenovo XClarity Orchestrator (LXCO) discovered the below vulnerability:

An attacker with access to a device on the local Lenovo XClarity Orchestrator (LXCO) network segment may be able to manipulate the local device to create an alternate communication channel which could allow the attacker, under certain conditions, to directly interact with backend LXCO API services typically inaccessible to users. While access controls may limit the scope of interaction, this could result in unauthorized access to internal functionality or data. This issue is not exploitable from remote networks.

NVD Source

Technical Analysis

CVE-2025-8557 requires adjacent network access, limiting remote exploitation but still posing risk in shared or local network environments.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.

A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), availability disruption (denial of service), with a CVSS base score of 8.8.