Thursday, February 6, 2025
HomeSecurity NewsLenovo Discovered a Backdoor in Network Switches Which Allows Attacker Could Perform...

Lenovo Discovered a Backdoor in Network Switches Which Allows Attacker Could Perform DDOS

Published on

SIEM as a Service

Follow Us on Google News

Lenovo discovered a backdoor in network switches that powered by Enterprise Network Operating System firmware during the security audit by Lenovo in the Telnet and Serial Console management interfaces.

An Authentication bypass mechanism Backdoor also called “HP Backdoor” was discovered with some Lenovo and IBM RackSwitch and BladeCenter switch that allows attacker gain the switch management console interface.

This bypass mechanism can be accessed when performing local authentication under specific and unique circumstances.

If the flaw will be perfectly exploited that it gives direct admin levels access to the switch that leads to performing massive DDOS Attack.

Authentication Bypass mechanism added in 2004

This mechanism was added in 2004 to ENOS when its owned by Nortel’s Blade Server Switch Business Unit.

Also Read Cisco ETA – Provides Solution for Detecting Malware in Encrypted Traffic

Lenovo discovered this while source code revision and auditing history as confirmed the same.According to Lenovo Following ENOS interfaces and authentication configurations are vulnerable.

Telnet and Serial Console when performing local authentication, or a combination of RADIUS, TACACS+, or LDAP and local authentication under specific circumstances described below
Web when performing a combination of RADIUS or TACACS+ and local authentication combined with an unlikely condition under specific circumstances described below
SSH for certain firmware released in May 2004 through June 2004 (only) when performing a combination of RADIUS or TACACS+ and local authentication under specific circumstances described below; the vulnerable code is present in more recent firmware, but not used

Circumstances

  • SSH in firmware released after June 2004 are not vulnerable
  • SSH and Web using only local authentication are not vulnerable
  • SSH, Web, Telnet, and Serial Console using LDAP, RADIUS, or TACACS+ without use of local authentication fallback are not vulnerable
  • Other management interfaces, such as SNMP, are not vulnerable

Lenovo Feels, the current authentication mechanism that is used in RackSwitch and  BladeCenter switches are being bypassed is completely unacceptable.

Mitigation – Lenovo

Lenovo Removed the source code that belongs to this authentication bypass mechanism and customers are advised to upgrade to the firmware which eliminates it.

If this firmware upgrade is not suddenly possible then customer adviced to following things.

  • Enable LDAP, RADIUS, or TACAS+ remote authentication AND
  • For any of LDAP, RADIUS, or TACAS+ that are enabled, disable the related “Backdoor” and “Secure Backdoor” local authentication fallback settings AND
  • Disable Telnet AND
  • Restrict physical access to the serial console port.

you can find the affected product version by this backdoor in Lenovo release a CVE() has been assigned( CVE-2017-3765) for this flaw.

Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Latest articles

OpenAI Data Breach – Threat Actor Allegedly Claims 20 Million Logins for Sale

OpenAI may have become the latest high-profile target of a significant data breach.A...

Lumma Stealer Attacking Windows Users In India With Fake Captcha Pages

Cybersecurity experts are raising alarms over a new wave of attacks targeting Windows users...

Beware of Lazarus LinkedIn Recruiting Scam Targeting Org’s to Deliver Malware

A new wave of cyberattacks orchestrated by the North Korea-linked Lazarus Group has been...

F5 BIG-IP SNMP Flaw Allows Attackers to Launch DoS Attacks

A recently disclosed vulnerability in F5's BIG-IP systems has raised alarm within the cybersecurity...

Supply Chain Attack Prevention

Free Webinar - Supply Chain Attack Prevention

Recent attacks like Polyfill[.]io show how compromised third-party components become backdoors for hackers. PCI DSS 4.0’s Requirement 6.4.3 mandates stricter browser script controls, while Requirement 12.8 focuses on securing third-party providers.

Join Vivekanand Gopalan (VP of Products – Indusface) and Phani Deepak Akella (VP of Marketing – Indusface) as they break down these compliance requirements and share strategies to protect your applications from supply chain attacks.

Discussion points

Meeting PCI DSS 4.0 mandates.
Blocking malicious components and unauthorized JavaScript execution.
PIdentifying attack surfaces from third-party dependencies.
Preventing man-in-the-browser attacks with proactive monitoring.

More like this

New FUD Malware Targets MacOS, Evading Antivirus and Security Tools

A new strain of Fully Undetectable (FUD) macOS malware, dubbed "Tiny FUD," has emerged,...

Google Blocks 2.28 Million Malicious Apps from Play Store in Security Crackdown

In a continued commitment to enhancing user safety and trust, Google has outlined significant...

Hackers Exploiting DNS Poisoning to Compromise Active Directory Environments

A groundbreaking technique for Kerberos relaying over HTTP, leveraging multicast poisoning, has been recently...