CVE-2017-8011 Hardcoded credentials in EMC ViPR SRM, EMC Storage M&R, EMC VNX M&R, EMC M&R (Watch4Net)
Remote attackers can use undocumented default credentials to execute arbitrary commands on EMC storage management systems.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2017-8011?
CVE-2017-8011 is a critical vulnerability in EMC ViPR SRM, EMC Storage M&R, EMC VNX M&R, EMC M&R (Watch4Net), published on 17 Jul 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
EMC ViPR SRM, EMC Storage M&R, EMC VNX M&R, EMC M&R for SAS Solution Packs (EMC ViPR SRM prior to 4.1, EMC Storage M&R prior to 4.1, EMC VNX M&R all versions, EMC M&R (Watch4Net) for SAS Solution Packs all versions) contain undocumented accounts with default passwords for Webservice Gateway and RMI JMX components. A remote attacker with the knowledge of the default password may potentially use these accounts to run arbitrary web service and remote procedure calls on the affected system.
Weakness: CWE-798
Which versions are affected by CVE-2017-8011?
It affects 4 products.
Products include Dell Emc M\&r, Dell Emc Storage Monitoring and Reporting, Dell Emc Vipr Srm, Dell Emc Vnx Monitoring and Reporting.
How do I fix CVE-2017-8011?
No fix has been published for CVE-2017-8011 yet. Limit exposure of the affected software until one is available.
Is CVE-2017-8011 being exploited?
There is no known exploitation of CVE-2017-8011 in the wild and no public exploit code.
Other vulnerabilities in EMC ViPR SRM, EMC Storage M&R, EMC VNX M&R, EMC M&R (Watch4Net)
Sources
Also known as GHSA-h8wj-7m8m-j6c8.