Strix
26.1K

CVE-2021-26588

CRITICALCVSS 9.8/10EPSS 1.75%

Last modified

CVE-2021-26588 is a critical-severity vulnerability rated 9.8/10 on the CVSS scale. A potential security vulnerability has been identified in HPE 3PAR StoreServ, HPE Primera Storage and HPE Alletra 9000 Storage array firmware. An unauthenticated user could remotely exploit the low complexity issue to execute code as administrator. EPSS estimates a 1.75% chance of exploitation in the next 30 days.

Description

A potential security vulnerability has been identified in HPE 3PAR StoreServ, HPE Primera Storage and HPE Alletra 9000 Storage array firmware. An unauthenticated user could remotely exploit the low complexity issue to execute code as administrator. This vulnerability impacts completely the confidentiality, integrity, availability of the array. HPE has made the following software updates and mitigation information to resolve the vulnerability in 3PAR, Primera and Alletra 9000 firmware.

Metrics

CVSS 3.1
9.8/10

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Probability
1.75%

75.1th percentile

Probability of exploitation in the next 30 days. Learn more

Affected Software

VendorProductVersions
Hpe3par Os3.3.1_mp5_p156
Hpe3par Os3.3.1_mu1
Hpe3par Os3.3.1_mu2_p157
Hpe3par Os3.3.2_ga_p_01
HpePrimera 630 Firmware>= 4.0.0, <= 4.3.3
HpePrimera 650 Firmware>= 4.0.0, <= 4.3.3
HpePrimera 670 Firmware>= 4.0.0, <= 4.3.3
HpeAlletra 9060 Firmware>= 9.3.0, <= 9.4.0
HpeAlletra 9080 Firmware>= 9.3.0, <= 9.4.0

References

Timeline

Published
Last Modified
Status
Modified

Frequently Asked Questions

What is CVE-2021-26588?
A potential security vulnerability has been identified in HPE 3PAR StoreServ, HPE Primera Storage and HPE Alletra 9000 Storage array firmware. An unauthenticated user could remotely exploit the low complexity issue to execute code as administrator. This vulnerability impacts completely the confidentiality, integrity, availability of the array. HPE has made the following software updates and mitigation information to resolve the vulnerability in 3PAR, Primera and Alletra 9000 firmware.
How severe is CVE-2021-26588?
CVE-2021-26588 has a CVSS score of 9.8/10 (CRITICAL severity). The EPSS model estimates a 1.75% probability of exploitation in the next 30 days.
How do I fix CVE-2021-26588?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2021-26588?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST