CVE-2021-21591 Hardcoded credentials in Unity
A local high-privilege user can exploit plain-text password storage to gain unauthorized access and escalate privileges on Dell EMC Unity systems.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-21591?
CVE-2021-21591 is a medium-severity vulnerability in Dell Unity, published on 12 Jul 2021. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Dell EMC Unity, Unity XT, and UnityVSA versions prior to 5.1.0.0.5.394 contain a plain-text password storage vulnerability. A local malicious user with high privileges may use the exposed password to gain access with the privileges of the compromised user.
Which versions are affected by CVE-2021-21591?
It affects 3 products.
Products include Dell Emc Unity Operating Environment, Dell Emc Unity Xt Operating Environment, Dell Emc Unityvsa Operating Environment.
How do I fix CVE-2021-21591?
No fix has been published for CVE-2021-21591 yet. Limit exposure of the affected software until one is available.
Is CVE-2021-21591 being exploited?
There is no known exploitation of CVE-2021-21591 in the wild and no public exploit code.
Other vulnerabilities in Dell Unity
Sources
Also known as GHSA-6rq3-pxgh-fw4x.