Lucene search

DellCVE-2017-4984

HistoryJun 19, 2017 - 12:29 p.m.

CVE-2017-4984

2017-06-1912:29:00

CWE-77

dell

web.nvd.nist.gov

cve-2017-4984

emc vnx2

emc vnx1

command injection

elevation of privileges

remote code execution

nvd

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

Confidence

High

EPSS

0.007

Percentile

80.2%

JSON

In EMC VNX2 versions prior to OE for File 8.1.9.211 and VNX1 versions prior to OE for File 7.1.80.8, an unauthenticated remote attacker may be able to elevate their permissions to root through a command injection. This may potentially be exploited by an attacker to run arbitrary code with root-level privileges on the targeted VNX Control Station system, aka remote code execution.

Affected configurations

Nvd

Node

emcvnx2_firmwareMatch-

AND

emcvnx2Match-

Node

emcvnx1_firmwareMatch-

AND

emcvnx1Match-

VendorProductVersionCPE
emcvnx2_firmware-cpe:2.3:o:emc:vnx2_firmware:-:*:*:*:*:*:*:*
emcvnx2-cpe:2.3:h:emc:vnx2:-:*:*:*:*:*:*:*
emcvnx1_firmware-cpe:2.3:o:emc:vnx1_firmware:-:*:*:*:*:*:*:*
emcvnx1-cpe:2.3:h:emc:vnx1:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
emc	vnx2_firmware	-	cpe:2.3:o:emc:vnx2_firmware:-:::::::*
emc	vnx2	-	cpe:2.3:h:emc:vnx2:-:::::::*
emc	vnx1_firmware	-	cpe:2.3:o:emc:vnx1_firmware:-:::::::*
emc	vnx1	-	cpe:2.3:h:emc:vnx1:-:::::::*

CNA Affected

[
  {
    "product": "EMC VNX2 versions prior to OE for File 8.1.9.211, EMC VNX1 versions prior to OE for File 7.1.80.8",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "EMC VNX2 versions prior to OE for File 8.1.9.211, EMC VNX1 versions prior to OE for File 7.1.80.8"
      }
    ]
  }
]

References

www.securityfocus.com/archive/1/540738/30/0/threaded

www.securityfocus.com/bid/99039

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

Confidence

High

EPSS

0.007

Percentile

80.2%

JSON

Related for CVE-2017-4984