Lucene search

TwcertCVE-2021-32525

HistoryJul 07, 2021 - 2:15 p.m.

CVE-2021-32525

2021-07-0714:15:11

CWE-798

CWE-259

twcert

web.nvd.nist.gov

cve-2021-32525

qsan storage manager

firmware

remote access vulnerability

hard-coded password

debug mode

control interface

nvd

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:S/C:C/I:C/A:C

CVSS3

9.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

AI Score

7.2

Confidence

High

EPSS

0.005

Percentile

76.4%

JSON

The same hard-coded password in QSAN Storage Manager’s in the firmware allows remote attackers to access the control interface with the administrator’s credential, entering the hard-coded password of the debug mode to execute the restricted system instructions. The referred vulnerability has been solved with the updated version of QSAN Storage Manager v3.3.3.

Affected configurations

Nvd

Node

qsanstorage_managerRange<3.3.1

VendorProductVersionCPE
qsanstorage_manager*cpe:2.3:a:qsan:storage_manager:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
qsan	storage_manager	*	cpe:2.3:a:qsan:storage_manager::::::::

CNA Affected

[
  {
    "product": "Storage Manager",
    "vendor": "QSAN",
    "versions": [
      {
        "lessThanOrEqual": "3.3.1",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

References

www.twcert.org.tw/tw/cp-132-4881-959d3-1.html

Social References

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:S/C:C/I:C/A:C

CVSS3

9.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

AI Score

7.2

Confidence

High

EPSS

0.005

Percentile

76.4%

JSON

Related for CVE-2021-32525