What’s Vulnerable › Vulnerabilities

CVE-2017-3765

• Severity: high (CVSS 7.0 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2018-01-10 · updated 2026-06-17
• Weakness: CWE-287

Description

In Enterprise Networking Operating System (ENOS) in Lenovo and IBM RackSwitch and BladeCenter products, an authentication bypass known as "HP Backdoor" was discovered during a Lenovo security audit in the serial console, Telnet, SSH, and Web interfaces. This bypass mechanism can be accessed when performing local authentication under specific circumstances. If exploited, admin-level access to the switch is granted.

Affected products

• Lenovo Group Ltd. Enterprise Network Operating System affecting Lenovo and IBM RackSwitch and BladeCenter Products: before 8.4.6.0 — fixed in 8.4.6.0

How to fix

Upgrade to a fixed version: Lenovo Group Ltd. Enterprise Network Operating System affecting Lenovo and IBM RackSwitch and BladeCenter Products 8.4.6.0. Check the vendor advisory for mitigations.

References

• http://www.securitytracker.com/id/1040296
• https://support.lenovo.com/us/en/product_security/LEN-16095
• http://www.securitytracker.com/id/1040296
• https://support.lenovo.com/us/en/product_security/LEN-16095

Get alerted when CVE-2017-3765 or the next vulnerability affects your stack