CVE-2021-32525 QSAN Storage Manager - Use of Hard-coded Password-2

Critical 9.1 Published 7 Jul 2021 Updated 17 Sep 2024

Remote attackers can use a hard-coded debug password to gain administrator access and execute restricted system instructions on QSAN Storage Manager.

Exploited in the wild: Not known
Login needed: An administrator
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2021-32525?

CVE-2021-32525 is a critical vulnerability in QSAN Storage Manager, published on 7 Jul 2021. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

The same hard-coded password in QSAN Storage Manager's in the firmware allows remote attackers to access the control interface with the administrator’s credential, entering the hard-coded password of the debug mode to execute the restricted system instructions. The referred vulnerability has been solved with the updated version of QSAN Storage Manager v3.3.3.

Weakness: CWE-798, CWE-259

Which versions are affected by CVE-2021-32525?

It affects 1 product.

Products include Qsan Storage Manager.

How do I fix CVE-2021-32525?

No fix has been published for CVE-2021-32525 yet. Limit exposure of the affected software until one is available.

Is CVE-2021-32525 being exploited?

There is no known exploitation of CVE-2021-32525 in the wild and no public exploit code.

Sources

Also known as GHSA-3p7w-fr8h-8fxc.