CVE-2023-27317 Information Disclosure Vulnerability in ONTAP 9

Medium 4.3 Published 15 Dec 2023 Updated 7 May 2025

Attackers with physical access can read sensitive data from FIPS-encrypted drives that incorrectly unlock after reboot or reinsertion in NetApp ONTAP systems.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2023-27317?

CVE-2023-27317 is a medium-severity vulnerability in NetApp ONTAP 9, published on 15 Dec 2023. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

Official description

ONTAP 9 versions 9.12.1P8, 9.13.1P4, and 9.13.1P5 are susceptible to a vulnerability which will cause all SAS-attached FIPS 140-2 drives to become unlocked after a system reboot or power cycle or a single SAS-attached FIPS 140-2 drive to become unlocked after reinsertion. This could lead to disclosure of sensitive information to an attacker with physical access to the unlocked drives.

Weakness: CWE-200

Which versions are affected by CVE-2023-27317?

It affects 1 product.

Products include Netapp Ontap.

How do I fix CVE-2023-27317?

No fix has been published for CVE-2023-27317 yet. Limit exposure of the affected software until one is available.

Is CVE-2023-27317 being exploited?

There is no known exploitation of CVE-2023-27317 in the wild and no public exploit code.

Sources

Also known as GHSA-xgfv-h6v5-c2rq.