CVE-2021-32525: QSAN Storage Manager, заобикаляне на вход и права

Описание

Оригинално описание

The same hard-coded password in QSAN Storage Manager's in the firmware allows remote attackers to access the control interface with the administrator’s credential, entering the hard-coded password of the debug mode to execute the restricted system instructions. The referred vulnerability has been solved with the updated version of QSAN Storage Manager v3.3.3.

Засегнати продукти

• QSAN Storage Manager: unspecified до 3.3.1

Вид слабост

• CWE-259 Използване на твърдо кодирана парола

История

Други уязвимости в QSAN Storage Manager

• 5.3CVE-2021-32528
• 7.5CVE-2021-32527
• 6.5CVE-2021-32526
• 9.1CVE-2021-32524
• 9.1CVE-2021-32523

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2021-32525
• https://nvd.nist.gov/vuln/detail/CVE-2021-32525
• https://www.twcert.org.tw/tw/cp-132-4881-959d3-1.html