Risk | Low |
Patch available | YES |
Number of vulnerabilities | 1 |
CVE-ID | CVE-2017-3765 |
CWE-ID | CWE-592 |
Exploitation vector | Local |
Public exploit | N/A |
Vulnerable software Subscribe |
Lenovo Service Framework Client/Desktop applications / Other client software |
Vendor | Lenovo |
Security Bulletin
This security bulletin contains one low risk vulnerability.
EUVDB-ID: #VU10152
Risk: Low
CVSSv3.1: 7.7 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2017-3765
CWE-ID:
CWE-592 - Authentication Bypass Issues
Exploit availability: No
DescriptionThe vulnerability allows a local attacker to bypass security restrictions on the target system.
The weakness exists in the Enterprise Network Operating System (ENOS) firmware due to the presence of a mechanism, known as HP Backdoor, for bypassing authentication on the affected switches. A local attacker can use credentials unique to a targeted switch to authenticate to the switch, bypass authentication and gain administrative-level access to the switch.
Successful exploitation of the vulnerability may result in system compromise.
Install update from vendor's website.
Lenovo Service Framework: All versions
CPE2.3 External linkshttp://support.lenovo.com/ua/en/product_security/len-16095
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.