Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2015-7817: IBM/Lenovo Switch Center admin panel may grant attacker admin rights

CVE-2015-7817 · published 10 years ago

Summary

The web management interface used by IBM System Networking Switch Center (versions before 7.3.1.5) and Lenovo Switch Center (versions before 8.1.2.0) can be tricked into giving a remote user full administrative access. Once an attacker has that access, they can ask the system to read any text file on the device, potentially exposing sensitive information. Apply the latest software updates from IBM and Lenovo as soon as possible to close this gap.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
ibm	system_networking_switch_center	<= 7.3.1.4 `cpe:2.3:a:ibm:system_networking_switch_center::::::::`
lenovo	switch_center	<= 8.1.1.0 `cpe:2.3:a:lenovo:switch_center::::::::`

Original advisory text

Race condition in the administration-panel web service in IBM System Networking Switch Center (SNSC) before 7.3.1.5 and Lenovo Switch Center before 8.1.2.0 allows remote attackers to obtain privileged-account access, and consequently provide FileReader.jsp input containing directory traversal sequences to read arbitrary text files, via a request to port 40080 or 40443.

References

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker partial control (estimated)

Severity

7.1 High

Exploitation

1% chance of attack within 30 days

Type

CWE-362Race Condition

Timeline

Published12 Nov 2015

Updated4 Nov 2026

First seen29 Sep 2026

Sources

CVE-2015-7817 · NVD

Track software like this

Free during beta