This vulnerability involves improper validation of TLS certificates in Lenovo XClarity Orchestrator (LXCO) version 2.2.0 microservices. Due to this flaw, an attacker on an adjacent network could potentially intercept sensitive data by executing a man-in-the-middle attack against HTTPS connections. The issue is classified under CWE-295 (Improper Certificate Validation). The CVSS v3.1 base score is 6.1, reflecting medium severity with attack vector as adjacent network, high attack complexity, no privileges required, no user interaction, and impact on confidentiality but not integrity or availability. No patch or official remediation level has been disclosed by Lenovo as of the publication date.

An attacker positioned on an adjacent network could exploit this vulnerability to intercept sensitive communications by defeating TLS certificate validation, potentially exposing confidential data transmitted over HTTPS. There is no indication of impact on data integrity or availability. No known active exploitation has been reported.

Patch status is not yet confirmed — check the Lenovo vendor advisory for current remediation guidance. Until an official fix is available, users should consider limiting network exposure of affected services and use network-level protections to reduce the risk of man-in-the-middle attacks. Monitor Lenovo communications for updates on patches or mitigations.