K81952114 : Authenticated iControl REST in Appliance mode vulnerability CVE-2022-26415

Security Advisory Description

When running in Appliance mode, an authenticated user assigned the Administrator role may be able to bypass Appliance mode restrictions, utilizing an undisclosed iControl REST endpoint. (CVE-2022-26415)

Impact

In Appliance mode, an authenticated user with valid user credentials assigned the Administrator role may be able to bypass Appliance mode restrictions. This is a control plane issue; there is no data plane exposure. Appliance mode is enforced by a specific license or may be enabled or disabled for individual Virtual Clustered Multiprocessing (vCMP) guest instances.

For information about Appliance mode, refer to K12815: Overview of Appliance mode.