This vulnerability in Lenovo XClarity Orchestrator (LXCO) version 2.2.0 involves improper neutralization of special elements used in operating system commands (CWE-78). It enables an authenticated attacker to execute arbitrary OS commands as a privileged user, potentially compromising confidentiality, integrity, and availability of the affected system. The CVSS v3.1 base score is 8.8, reflecting network attack vector, low attack complexity, required privileges, no user interaction, and high impact on confidentiality, integrity, and availability. No patch or official remediation level has been published yet, and no known exploits are reported in the wild.

Successful exploitation allows an authenticated attacker to execute arbitrary operating system commands with privileged user rights, leading to full system compromise including unauthorized disclosure, modification, or destruction of data and disruption of service.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict authenticated access to trusted users only and monitor for suspicious activity related to command execution.