Saturday, May 18, 2024

Lenovo Discovered a Backdoor in Network Switches Which Allows Attacker Could Perform DDOS

Lenovo discovered a backdoor in network switches that powered by Enterprise Network Operating System firmware during the security audit by Lenovo in the Telnet and Serial Console management interfaces.

An Authentication bypass mechanism Backdoor also called “HP Backdoor” was discovered with some Lenovo and IBM RackSwitch and BladeCenter switch that allows attacker gain the switch management console interface.

This bypass mechanism can be accessed when performing local authentication under specific and unique circumstances.

If the flaw will be perfectly exploited that it gives direct admin levels access to the switch that leads to performing massive DDOS Attack.

Authentication Bypass mechanism added in 2004

This mechanism was added in 2004 to ENOS when its owned by Nortel’s Blade Server Switch Business Unit.

Also Read Cisco ETA – Provides Solution for Detecting Malware in Encrypted Traffic

Lenovo discovered this while source code revision and auditing history as confirmed the same.According to Lenovo Following ENOS interfaces and authentication configurations are vulnerable.

Telnet and Serial Console when performing local authentication, or a combination of RADIUS, TACACS+, or LDAP and local authentication under specific circumstances described below
Web when performing a combination of RADIUS or TACACS+ and local authentication combined with an unlikely condition under specific circumstances described below
SSH for certain firmware released in May 2004 through June 2004 (only) when performing a combination of RADIUS or TACACS+ and local authentication under specific circumstances described below; the vulnerable code is present in more recent firmware, but not used


  • SSH in firmware released after June 2004 are not vulnerable
  • SSH and Web using only local authentication are not vulnerable
  • SSH, Web, Telnet, and Serial Console using LDAP, RADIUS, or TACACS+ without use of local authentication fallback are not vulnerable
  • Other management interfaces, such as SNMP, are not vulnerable

Lenovo Feels, the current authentication mechanism that is used in RackSwitch and  BladeCenter switches are being bypassed is completely unacceptable.

Mitigation – Lenovo

Lenovo Removed the source code that belongs to this authentication bypass mechanism and customers are advised to upgrade to the firmware which eliminates it.

If this firmware upgrade is not suddenly possible then customer adviced to following things.

  • Enable LDAP, RADIUS, or TACAS+ remote authentication AND
  • For any of LDAP, RADIUS, or TACAS+ that are enabled, disable the related “Backdoor” and “Secure Backdoor” local authentication fallback settings AND
  • Disable Telnet AND
  • Restrict physical access to the serial console port.

you can find the affected product version by this backdoor in Lenovo release a CVE() has been assigned( CVE-2017-3765) for this flaw.


Latest articles

Norway Recommends Replacing SSLVPN/WebVPN to Stop Cyber Attacks

A very important message from the Norwegian National Cyber Security Centre (NCSC) says that...

New Linux Backdoor Attacking Linux Users Via Installation Packages

Linux is widely used in numerous servers, cloud infrastructure, and Internet of Things devices,...

ViperSoftX Malware Uses Deep Learning Model To Execute Commands

ViperSoftX malware, known for stealing cryptocurrency information, now leverages Tesseract, an open-source OCR engine,...

Santander Data Breach: Hackers Accessed Company Database

Santander has confirmed that there was a major data breach that affected its workers...

U.S. Govt Announces Rewards up to $5 Million for North Korean IT Workers

The U.S. government has offered a prize of up to $5 million for information...

Russian APT Hackers Attacking Critical Infrastructure

Russia leverages a mix of state-backed Advanced Persistent Threat (APT) groups and financially motivated...

Millions Of IoT Devices Vulnerable To Attacks Leads To Full Takeover

Researchers discovered four significant vulnerabilities in the ThroughTek Kalay Platform, which powers 100 million...
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Free Webinar

Live API Attack Simulation

94% of organizations experience security problems in production APIs, and one in five suffers a data breach. As a result, cyber-attacks on APIs increased from 35% in 2022 to 46% in 2023, and this trend continues to rise.
Key takeaways include:

  • An exploit of OWASP API Top 10 vulnerability
  • A brute force ATO (Account Takeover) attack on API
  • A DDoS attack on an API
  • Positive security model automation to prevent API attacks

Related Articles