7

CVE-2017-3765

In Enterprise Networking Operating System (ENOS) in Lenovo and IBM RackSwitch and BladeCenter products, an authentication bypass known as "HP Backdoor" was discovered during a Lenovo security audit in the serial console, Telnet, SSH, and Web interfaces. This bypass mechanism can be accessed when performing local authentication under specific circumstances. If exploited, admin-level access to the switch is granted.

Data is provided by the National Vulnerability Database (NVD)
Lenovo ≫ Enterprise Network Operating System Version < 8.4.6.0
   Ibm ≫ 1g L2-7 Slb Switch For Bladecenter Version-
   Ibm ≫ Bladecenter 1:10g Uplink Ethernet Switch Module Version-
   Ibm ≫ Bladecenter Layer 2/3 Copper Ethernet Switch Module Version-
   Ibm ≫ Bladecenter Virtual Fabric 10gb Switch Module Version-
   Ibm ≫ Flex System En2092 1gb Ethernet Scalable Switch Version-
   Ibm ≫ Flex System Fabric Cn4093 10gb Converged Scalable Switch Version-
   Ibm ≫ Flex System Fabric En4093/en4093r 10gb Scalable Switch Version-
   Ibm ≫ Flex System Fabric Si4093 10gb System Interconnect Module Version-
   Ibm ≫ Rackswitch G8052 Version-
   Ibm ≫ Rackswitch G8124 Version-
   Ibm ≫ Rackswitch G8124e Version-
   Ibm ≫ Rackswitch G8264 Version-
   Ibm ≫ Rackswitch G8264cs Version-
   Ibm ≫ Rackswitch G8264t Version-
   Ibm ≫ Rackswitch G8316 Version-
   Ibm ≫ Rackswitch G8332 Version-
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 0.04% 0.07
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 7 1 5.9
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
nvd@nist.gov 6.2 1.9 10
AV:L/AC:H/Au:N/C:C/I:C/A:C
CWE-287 Improper Authentication

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.