Lucene search

DellCVE-2021-21505

HistoryMay 06, 2021 - 1:15 p.m.

CVE-2021-21505

2021-05-0613:15:11

CWE-1188

CWE-255

dell

web.nvd.nist.gov

dell

emc

microsoft

azure stack hub

cve-2021-21505

vulnerability

default credentials

root privileges

nvd

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.5

Confidence

High

EPSS

0.005

Percentile

76.1%

JSON

Dell EMC Integrated System for Microsoft Azure Stack Hub, versions 1906 – 2011, contain an undocumented default iDRAC account. A remote unauthenticated attacker, with the knowledge of the default credentials, could potentially exploit this to log in to the system to gain root privileges.

Affected configurations

Nvd

Vulners

Node

dellemc_integrated_system_for_microsoft_azure_stack_hubMatch-

AND

dellemc_integrated_system_for_microsoft_azure_stack_hub_firmwareRange1906–2011

VendorProductVersionCPE
dellemc_integrated_system_for_microsoft_azure_stack_hub-cpe:2.3:h:dell:emc_integrated_system_for_microsoft_azure_stack_hub:-:*:*:*:*:*:*:*
dellemc_integrated_system_for_microsoft_azure_stack_hub_firmware*cpe:2.3:o:dell:emc_integrated_system_for_microsoft_azure_stack_hub_firmware:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
dell	emc_integrated_system_for_microsoft_azure_stack_hub	-	cpe:2.3:h:dell:emc_integrated_system_for_microsoft_azure_stack_hub:-:::::::*
dell	emc_integrated_system_for_microsoft_azure_stack_hub_firmware	*	cpe:2.3:o:dell:emc_integrated_system_for_microsoft_azure_stack_hub_firmware::::::::

CNA Affected

[
  {
    "product": "Dell EMC Integrated System for Microsoft Azure Stack Hub",
    "vendor": "Dell",
    "versions": [
      {
        "lessThan": "2102",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

References

www.dell.com/support/kbdoc/en-us/000186008/dsa-2021-020-dell-emc-integrated-system-for-microsoft-azure-stack-hub-security-update-for-an-idrac-undocumented-account-vulnerability

Social References

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.5

Confidence

High

EPSS

0.005

Percentile

76.1%

JSON

Related for CVE-2021-21505