This vulnerability involves improper validation of TLS certificates in Lenovo XClarity Orchestrator (LXCO) version 2.2.0 microservices. An attacker on an adjacent network could exploit this weakness to intercept sensitive data by conducting a man-in-the-middle attack on HTTPS connections. The issue is classified under CWE-295, indicating a failure to properly validate certificates, which undermines the security of encrypted communications. The CVSS v3.1 base score is 6.1, reflecting a medium severity with attack vector limited to adjacent network, high attack complexity, no privileges required, no user interaction, and impact limited to confidentiality.

An attacker positioned on the same or adjacent network segment could exploit this vulnerability to intercept sensitive information transmitted over HTTPS by exploiting the improper certificate validation. This compromises confidentiality but does not affect integrity or availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the Lenovo vendor advisory for current remediation guidance. Until a fix is available, limit exposure by restricting network access to the affected microservices to trusted networks only. Monitor official Lenovo communications for updates on patches or mitigations.