CVE-2021-21547 Hardcoded credentials in Unity
A local high-privilege user can access plain-text administrator credentials stored by the Upgrade Readiness Utility, leading to account takeover.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-21547?
CVE-2021-21547 is a medium-severity vulnerability in Dell Unity Operating Environment, published on 30 Apr 2021. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Dell EMC Unity, UnityVSA, and Unity XT versions prior to 5.0.7.0.5.008 contain a plain-text password storage vulnerability when the Dell Upgrade Readiness Utility is run on the system. The credentials of the Unisphere Administrator are stored in plain text. A local malicious user with high privileges may use the exposed password to gain access with the privileges of the compromised user.
Weakness: CWE-312
Which versions are affected by CVE-2021-21547?
It affects 3 products.
Products include Dell Unity Operating Environment, Dell Unity Xt Operating Environment, Dell Unityvsa Operating Environment.
How do I fix CVE-2021-21547?
No fix has been published for CVE-2021-21547 yet. Limit exposure of the affected software until one is available.
Is CVE-2021-21547 being exploited?
There is no known exploitation of CVE-2021-21547 in the wild and no public exploit code.
Other vulnerabilities in Dell Unity Operating Environment
Sources
Also known as GHSA-9qwc-8pqf-mrxv.