QLogic 4Gb Fibre Channel 5.5.2.6.0 and 4/8Gb SAN 7.10.1.20.0 switch modules for IBM BladeCenter: Three undocumented

CVSS 9.8CVE-2018-18202Firmware, BMC & network fabriccurated

Impact

Three undocumented accounts - support, diags and prom - each with a fixed password, baked into the FC switch module firmware. Anyone who knows them owns the switch module: zoning, port state, firmware. The reason this belongs in a modern GPU-datacenter database is not BladeCenter itself but the pattern - embedded FC switch modules and SAS/FC expander boards inherited with second-hand chassis carry vendor service accounts that no amount of operator password hygiene touches, and nothing in a normal build process ever looks for them.

Who can reach it

Anyone who can reach the module's management interface (telnet/SSH/web) on the chassis management network. Credentials are public.

What to do

Unfixable by configuration - the accounts are in firmware. Either upgrade to a firmware release where they are removed, if one exists for your module, or retire the module. Practically, for inherited or second-hand chassis: treat every embedded switch/expander module as carrying vendor backdoor accounts until proven otherwise, keep chassis management on an isolated segment no tenant or workload VLAN can route to, and make 'scan for vendor service accounts' part of hardware intake rather than something you do after an incident.

References

http://misteralfa-hack.blogspot.com/2018/10/ibm-bladecenter-qlogic-4g-fibre-channel.html https://nvd.nist.gov/vuln/detail/CVE-2018-18202

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.