CVE-2017-3765

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2017-3765
In Enterprise Networking Operating System (ENOS) in Lenovo and IBM RackSwitch and BladeCenter products, an authentication bypass known as "HP Backdoor" was discovered during a Lenovo security audit in the serial console, Telnet, SSH, and Web interfaces. This bypass mechanism can be accessed when performing local authentication under specific circumstances. If exploited, admin-level access to the switch is granted.

7.0 /10

CVSS v3 : HIGH

V3 Legend

Vector : AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability : 1.0 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity HIGH

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

6.2 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:L/AC:H/Au:N/C:C/I:C/A:C

Exploitability : 1.9 / Impact : 10.0

Access Vector LOCAL

Access Complexity HIGH

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References
Link Resource
http://www.securitytracker.com/id/1040296 Third Party Advisory
https://support.lenovo.com/us/en/product_security/LEN-16095 Mitigation Patch Vendor Advisory
Configurations

Configuration 1 (hide)

AND
cpe:2.3:o:lenovo:enterprise_network_operating_system:*:*:*:*:*:*:*:*
OR cpe:2.3:h:lenovo:flex_system_fabric_cn4093_10gb_converged_scalable_switch:-:*:*:*:*:*:*:*
cpe:2.3:h:lenovo:flex_system_fabric_en4093r_10gb_scalable_switch:-:*:*:*:*:*:*:*
cpe:2.3:h:lenovo:flex_system_fabric_si4093_10gb_system_interconnect_module:-:*:*:*:*:*:*:*
cpe:2.3:h:lenovo:flex_system_si4091_system_interconnect_module:-:*:*:*:*:*:*:*
cpe:2.3:h:lenovo:rackswitch_g7028:-:*:*:*:*:*:*:*
cpe:2.3:h:lenovo:rackswitch_g7052:-:*:*:*:*:*:*:*
cpe:2.3:h:lenovo:rackswitch_g8052:-:*:*:*:*:*:*:*
cpe:2.3:h:lenovo:rackswitch_g8124e:-:*:*:*:*:*:*:*
cpe:2.3:h:lenovo:rackswitch_g8264:-:*:*:*:*:*:*:*
cpe:2.3:h:lenovo:rackswitch_g8264cs:-:*:*:*:*:*:*:*
cpe:2.3:h:lenovo:rackswitch_g8272:-:*:*:*:*:*:*:*
cpe:2.3:h:lenovo:rackswitch_g8296:-:*:*:*:*:*:*:*
cpe:2.3:h:lenovo:rackswitch_g8332:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND
cpe:2.3:o:lenovo:enterprise_network_operating_system:*:*:*:*:*:*:*:*
OR cpe:2.3:h:ibm:1g_l2-7_slb_switch_for_bladecenter:-:*:*:*:*:*:*:*
cpe:2.3:h:ibm:bladecenter_1\:10g_uplink_ethernet_switch_module:-:*:*:*:*:*:*:*
cpe:2.3:h:ibm:bladecenter_layer_2\/3_copper_ethernet_switch_module:-:*:*:*:*:*:*:*
cpe:2.3:h:ibm:bladecenter_virtual_fabric_10gb_switch_module:-:*:*:*:*:*:*:*
cpe:2.3:h:ibm:flex_system_en2092_1gb_ethernet_scalable_switch:-:*:*:*:*:*:*:*
cpe:2.3:h:ibm:flex_system_fabric_cn4093_10gb_converged_scalable_switch:-:*:*:*:*:*:*:*
cpe:2.3:h:ibm:flex_system_fabric_en4093\/en4093r_10gb_scalable_switch:-:*:*:*:*:*:*:*
cpe:2.3:h:ibm:flex_system_fabric_si4093_10gb_system_interconnect_module:-:*:*:*:*:*:*:*
cpe:2.3:h:ibm:rackswitch_g8052:-:*:*:*:*:*:*:*
cpe:2.3:h:ibm:rackswitch_g8124:-:*:*:*:*:*:*:*
cpe:2.3:h:ibm:rackswitch_g8124e:-:*:*:*:*:*:*:*
cpe:2.3:h:ibm:rackswitch_g8264:-:*:*:*:*:*:*:*
cpe:2.3:h:ibm:rackswitch_g8264cs:-:*:*:*:*:*:*:*
cpe:2.3:h:ibm:rackswitch_g8264t:-:*:*:*:*:*:*:*
cpe:2.3:h:ibm:rackswitch_g8316:-:*:*:*:*:*:*:*
cpe:2.3:h:ibm:rackswitch_g8332:-:*:*:*:*:*:*:*
History

No history.

Information

Published : 2018-01-10 18:29

Updated : 2024-02-04 19:29

NVD link : CVE-2017-3765

Mitre link : CVE-2017-3765

CVE.ORG link : CVE-2017-3765

JSON object : View

Products Affected

ibm

  • rackswitch_g8124e
  • rackswitch_g8264
  • flex_system_fabric_cn4093_10gb_converged_scalable_switch
  • flex_system_fabric_si4093_10gb_system_interconnect_module
  • rackswitch_g8052
  • rackswitch_g8264t
  • rackswitch_g8332
  • rackswitch_g8124
  • 1g_l2-7_slb_switch_for_bladecenter
  • rackswitch_g8316
  • flex_system_en2092_1gb_ethernet_scalable_switch
  • bladecenter_layer_2\/3_copper_ethernet_switch_module
  • bladecenter_1\
  • flex_system_fabric_en4093\/en4093r_10gb_scalable_switch
  • bladecenter_virtual_fabric_10gb_switch_module
  • rackswitch_g8264cs

lenovo

  • rackswitch_g7028
  • rackswitch_g7052
  • rackswitch_g8124e
  • rackswitch_g8264
  • rackswitch_g8264cs
  • flex_system_si4091_system_interconnect_module
  • flex_system_fabric_si4093_10gb_system_interconnect_module
  • flex_system_fabric_cn4093_10gb_converged_scalable_switch
  • rackswitch_g8272
  • rackswitch_g8296
  • enterprise_network_operating_system
  • rackswitch_g8052
  • flex_system_fabric_en4093r_10gb_scalable_switch
  • rackswitch_g8332
CWE
CWE-287

Improper Authentication