Lucene search

NetappCVE-2020-8573

HistoryJun 29, 2020 - 2:15 p.m.

CVE-2020-8573

2020-06-2914:15:12

CWE-798

netapp

web.nvd.nist.gov

cve-2020-8573

netapp hci

baseboard management controllers

bmc

default password

denial of service

dos

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:N/I:N/A:P

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

AI Score

6.6

Confidence

High

EPSS

0.001

Percentile

50.1%

JSON

The NetApp HCI H610C, H615C and H610S Baseboard Management Controllers (BMC) are shipped with a documented default account and password that should be changed during the initial node setup. During upgrades to Element 11.8 and 12.0 or the Compute Firmware Bundle 12.2.92 the BMC account password on the H610C, H615C and H610S platforms is reset to the default documented value which could allow remote attackers to cause a Denial of Service (DoS).

Affected configurations

Nvd

Node

netapphci_h610sMatch-

AND

netapphci_h610s_firmwareMatch-

VendorProductVersionCPE
netapphci_h610s-cpe:2.3:h:netapp:hci_h610s:-:*:*:*:*:*:*:*
netapphci_h610s_firmware-cpe:2.3:o:netapp:hci_h610s_firmware:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
netapp	hci_h610s	-	cpe:2.3:h:netapp:hci_h610s:-:::::::*
netapp	hci_h610s_firmware	-	cpe:2.3:o:netapp:hci_h610s_firmware:-:::::::*

CNA Affected

[
  {
    "product": "NetApp HCI Baseboard Management Controller (BMC) HCI H610C, NetApp HCI Baseboard Management Controller (BMC) HCI H615C, NetApp HCI Baseboard Management Controller (BMC) HCI H610S",
    "vendor": "NetApp",
    "versions": [
      {
        "status": "affected",
        "version": "Element OS v11.8"
      },
      {
        "status": "affected",
        "version": "Element OS v12.0"
      },
      {
        "status": "affected",
        "version": "Compute Firmware Bundle v12.2.92"
      }
    ]
  }
]

References

security.netapp.com/advisory/ntap-20200626-0001/

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:N/I:N/A:P

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

AI Score

6.6

Confidence

High

EPSS

0.001

Percentile

50.1%

JSON

Related for CVE-2020-8573