PT-2025-12718 · Netapp · Snapcenter
CVE-2025-26512
·
Publicado
2025-03-24
·
Atualizado
2025-04-13
CVSS v3.1
9.9
Crítica
| Vetor | AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
SnapCenter versions prior to 6.0.1P1 and 6.1P1
Description
A critical flaw in NetApp SnapCenter may allow an authenticated SnapCenter Server user to become an admin user on a remote system where a SnapCenter plug-in has been installed. This issue affects enterprise backups and is not niche, as SnapCenter powers these backups. The estimated number of potentially affected devices worldwide is not specified. There is no information about real-world incidents where this issue was exploited.
Recommendations
Update to version 6.0.1P1 or 6.1P1 to resolve the issue. As a temporary workaround, consider restricting access to the SnapCenter plug-in on remote systems until a patch is applied. Avoid using the SnapCenter Server with affected versions on systems where elevated privileges could be exploited.
Correção
LPE
Incorrect Privilege Assignment
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Snapcenter