Improper authentication in Lenovo Enterprise Network Operating System affecting Lenovo…
Priority LOW 30CWE-287Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- High
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-287.
Summary
In Enterprise Networking Operating System (ENOS) in Lenovo and IBM RackSwitch and BladeCenter products, an authentication bypass known as "HP Backdoor" was discovered during a Lenovo security audit in the serial console, Telnet, SSH, and Web interfaces. This bypass mechanism can be accessed when performing local authentication under specific circumstances. If exploited, admin-level access to the switch is granted.
Why it matters now
EPSS 0.00269 19th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Lenovo | Enterprise Network Operating System affecting Lenovo and IBM RackSwitch and BladeCenter Products | Earlier than | — | No fix listed | CNA |
- Enterprise Network Operating System affecting Lenovo and IBM RackSwitch and BladeCenter Products VendorLenovo Affected Earlier than Fixed in — No fix listed CNA
CPE configurations NVD · 30
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:lenovo:enterprise_network_operating_system:*:*:*:*:*:*:*:* | before 8.4.6.0 | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:flex_system_fabric_cn4093_10gb_converged_scalable_switch:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:h:lenovo:flex_system_fabric_en4093r_10gb_scalable_switch:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:h:lenovo:flex_system_fabric_si4093_10gb_system_interconnect_module:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:h:lenovo:flex_system_si4091_system_interconnect_module:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:h:lenovo:rackswitch_g7028:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:h:lenovo:rackswitch_g7052:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:h:lenovo:rackswitch_g8052:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:h:lenovo:rackswitch_g8124e:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:h:lenovo:rackswitch_g8264:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
- cpe:2.3:o:lenovo:enterprise_network_operating_system:*:*:*:*:*:*:*:* Versions before 8.4.6.0 Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:flex_system_fabric_cn4093_10gb_converged_scalable_switch:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:h:lenovo:flex_system_fabric_en4093r_10gb_scalable_switch:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:h:lenovo:flex_system_fabric_si4093_10gb_system_interconnect_module:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:h:lenovo:flex_system_si4091_system_interconnect_module:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:h:lenovo:rackswitch_g7028:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:h:lenovo:rackswitch_g7052:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:h:lenovo:rackswitch_g8052:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:h:lenovo:rackswitch_g8124e:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:h:lenovo:rackswitch_g8264:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
Show 20 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:h:lenovo:rackswitch_g8264cs:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:h:lenovo:rackswitch_g8272:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:h:lenovo:rackswitch_g8296:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:h:lenovo:rackswitch_g8332:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:h:ibm:1g_l2-7_slb_switch_for_bladecenter:-:*:*:*:*:*:*:* | not specified by NVD | Running on | IBM |
| cpe:2.3:h:ibm:bladecenter_1\:10g_uplink_ethernet_switch_module:-:*:*:*:*:*:*:* | 10g_uplink_ethernet_switch_module | Running on | IBM |
| cpe:2.3:h:ibm:bladecenter_layer_2\/3_copper_ethernet_switch_module:-:*:*:*:*:*:*:* | not specified by NVD | Running on | IBM |
| cpe:2.3:h:ibm:bladecenter_virtual_fabric_10gb_switch_module:-:*:*:*:*:*:*:* | not specified by NVD | Running on | IBM |
| cpe:2.3:h:ibm:flex_system_en2092_1gb_ethernet_scalable_switch:-:*:*:*:*:*:*:* | not specified by NVD | Running on | IBM |
| cpe:2.3:h:ibm:flex_system_fabric_cn4093_10gb_converged_scalable_switch:-:*:*:*:*:*:*:* | not specified by NVD | Running on | IBM |
| cpe:2.3:h:ibm:flex_system_fabric_en4093\/en4093r_10gb_scalable_switch:-:*:*:*:*:*:*:* | not specified by NVD | Running on | IBM |
| cpe:2.3:h:ibm:flex_system_fabric_si4093_10gb_system_interconnect_module:-:*:*:*:*:*:*:* | not specified by NVD | Running on | IBM |
| cpe:2.3:h:ibm:rackswitch_g8052:-:*:*:*:*:*:*:* | not specified by NVD | Running on | IBM |
| cpe:2.3:h:ibm:rackswitch_g8124:-:*:*:*:*:*:*:* | not specified by NVD | Running on | IBM |
| cpe:2.3:h:ibm:rackswitch_g8124e:-:*:*:*:*:*:*:* | not specified by NVD | Running on | IBM |
| cpe:2.3:h:ibm:rackswitch_g8264:-:*:*:*:*:*:*:* | not specified by NVD | Running on | IBM |
| cpe:2.3:h:ibm:rackswitch_g8264cs:-:*:*:*:*:*:*:* | not specified by NVD | Running on | IBM |
| cpe:2.3:h:ibm:rackswitch_g8264t:-:*:*:*:*:*:*:* | not specified by NVD | Running on | IBM |
| cpe:2.3:h:ibm:rackswitch_g8316:-:*:*:*:*:*:*:* | not specified by NVD | Running on | IBM |
| cpe:2.3:h:ibm:rackswitch_g8332:-:*:*:*:*:*:*:* | not specified by NVD | Running on | IBM |
- cpe:2.3:h:lenovo:rackswitch_g8264cs:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:h:lenovo:rackswitch_g8272:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:h:lenovo:rackswitch_g8296:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:h:lenovo:rackswitch_g8332:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:h:ibm:1g_l2-7_slb_switch_for_bladecenter:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·IBM
- cpe:2.3:h:ibm:bladecenter_1\:10g_uplink_ethernet_switch_module:-:*:*:*:*:*:*:* Versions 10g_uplink_ethernet_switch_module Running on ·IBM
- cpe:2.3:h:ibm:bladecenter_layer_2\/3_copper_ethernet_switch_module:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·IBM
- cpe:2.3:h:ibm:bladecenter_virtual_fabric_10gb_switch_module:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·IBM
- cpe:2.3:h:ibm:flex_system_en2092_1gb_ethernet_scalable_switch:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·IBM
- cpe:2.3:h:ibm:flex_system_fabric_cn4093_10gb_converged_scalable_switch:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·IBM
- cpe:2.3:h:ibm:flex_system_fabric_en4093\/en4093r_10gb_scalable_switch:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·IBM
- cpe:2.3:h:ibm:flex_system_fabric_si4093_10gb_system_interconnect_module:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·IBM
- cpe:2.3:h:ibm:rackswitch_g8052:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·IBM
- cpe:2.3:h:ibm:rackswitch_g8124:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·IBM
- cpe:2.3:h:ibm:rackswitch_g8124e:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·IBM
- cpe:2.3:h:ibm:rackswitch_g8264:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·IBM
- cpe:2.3:h:ibm:rackswitch_g8264cs:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·IBM
- cpe:2.3:h:ibm:rackswitch_g8264t:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·IBM
- cpe:2.3:h:ibm:rackswitch_g8316:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·IBM
- cpe:2.3:h:ibm:rackswitch_g8332:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·IBM
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2017-3765
- 2026-10-03 Alias added: GHSA-6r95-2q8q-g3c2
References
Sources
- CVE-2017-3765 · CVE Program
- CVE-2017-3765 · NVD
- FIRST EPSS
- GHSA-6r95-2q8q-g3c2 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences