CVE-2020-8573

The NetApp HCI H610C, H615C and H610S Baseboard Management Controllers (BMC) are shipped with a documented default account and password that should be changed during the initial node setup. During upgrades to Element 11.8 and 12.0 or the Compute Firmware Bundle 12.2.92 the BMC account password on the H610C, H615C and H610S platforms is reset to the default documented value which could allow remote attackers to cause a Denial of Service (DoS).

CVSS v3 6.5 MEDIUM
CVSS v2.0 4.0 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

4.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:S/C:N/I:N/A:P

Exploitability : 8.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact PARTIAL

References

Link	Resource
https://security.netapp.com/advisory/ntap-20200626-0001/	Vendor Advisory
https://security.netapp.com/advisory/ntap-20200626-0001/	Vendor Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:netapp:hci_h610s_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:netapp:hci_h610s:-:*:*:*:*:*:*:*

History

21 Nov 2024, 05:39

Type	Values Removed	Values Added
References	~~() https://security.netapp.com/advisory/ntap-20200626-0001/ - Vendor Advisory~~	() https://security.netapp.com/advisory/ntap-20200626-0001/ - Vendor Advisory

Information

Published : 2020-06-29 14:15

Updated : 2024-11-21 05:39

NVD link : CVE-2020-8573

Mitre link : CVE-2020-8573

CVE.ORG link : CVE-2020-8573

JSON object : View

Products Affected

netapp

hci_h610s
hci_h610s_firmware

CWE

CWE-798

Use of Hard-coded Credentials

{"id": "CVE-2020-8573", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:N/I:N/A:P", "authentication": "SINGLE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "published": "2020-06-29T14:15:12.380", "references": [{"url": "https://security.netapp.com/advisory/ntap-20200626-0001/", "tags": ["Vendor Advisory"], "source": "security-alert@netapp.com"}, {"url": "https://security.netapp.com/advisory/ntap-20200626-0001/", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-798"}]}], "descriptions": [{"lang": "en", "value": "The NetApp HCI H610C, H615C and H610S Baseboard Management Controllers (BMC) are shipped with a documented default account and password that should be changed during the initial node setup. During upgrades to Element 11.8 and 12.0 or the Compute Firmware Bundle 12.2.92 the BMC account password on the H610C, H615C and H610S platforms is reset to the default documented value which could allow remote attackers to cause a Denial of Service (DoS)."}, {"lang": "es", "value": "El NetApp HCI H610C, H615C y H610S Baseboard Management Controller (BMC) se entrega con una cuenta y una contrase\u00f1a predeterminadas documentadas que deben ser cambiadas durante la configuraci\u00f3n inicial del nodo. Durante las actualizaciones en Element versiones 11.8 y 12.0 o el Compute Firmware Bundle 12.2.92, la contrase\u00f1a de la cuenta de BMC H610C, H615C y H610S se restablece al valor documentado predeterminado el cual permite a atacantes remotos causar una Denegaci\u00f3n de Servicio (DoS)"}], "lastModified": "2024-11-21T05:39:03.477", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:netapp:hci_h610s_firmware:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "910D39ED-5E36-42F2-B824-E7F4A2ED0BD7"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:netapp:hci_h610s:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "33960CC8-DC73-4E15-8A19-686F5F528006"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "security-alert@netapp.com"}