CVE-2020-5684 Security feature bypass in Management software for NEC Storage disk array system
Man-in-the-middle attackers can eavesdrop on or alter encrypted communications due to improper certificate verification in NEC Storage Manager clients.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-5684?
CVE-2020-5684 is a medium-severity vulnerability in Management software for NEC Storage disk array system, published on 24 Dec 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
iSM client versions from V5.1 prior to V12.1 running on NEC Storage Manager or NEC Storage Manager Express does not verify a server certificate properly, which allows a man-in-the-middle attacker to eavesdrop on an encrypted communication or alter the communication via a crafted certificate.
Weakness: CWE-295
Which versions are affected by CVE-2020-5684?
It affects 1 product.
Products include Nec Ism Server.
How do I fix CVE-2020-5684?
No fix has been published for CVE-2020-5684 yet. Limit exposure of the affected software until one is available.
Is CVE-2020-5684 being exploited?
There is no known exploitation of CVE-2020-5684 in the wild and no public exploit code.
Sources
Also known as GHSA-87vv-9cj6-q2hc.