PT-2020-18430 · Dell Emc · Dell Emc Isilon

Published 2020-05-20 · Updated 2020-05-21 · CVE-2020-5365

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Dell EMC Isilon versions 8.2.2 and earlier

Description The issue concerns a pre-configured support account, remotesupport, which is bundled in the Dell EMC Isilon OneFS installation and used for diagnostics and other support functions. Although the default password for this account is different for every cluster, it is predictable, posing a security risk.

Recommendations For Dell EMC Isilon versions 8.2.2 and earlier, consider changing the default password of the remotesupport account to a strong, unpredictable password to mitigate the risk of exploitation. As a temporary workaround, restrict access to the remotesupport account until a more secure configuration can be implemented.

Fix

Use of Insufficiently Random Values

Weakness Enumeration

CWE-330

CWE-341

Related Identifiers

CVE-2020-5365

Affected Products

Dell Emc Isilon

References · 4

• https://osv.dev/vulnerability/CVE-2020-5365 · Vendor Advisory
• https://dell.com/support/security/en-us/details/543775/DSA-2020-124-Dell-EMC-Isilon-OneFS-Security-Update-for-Multiple-Vulnerabilities · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-5365 · Security Note
• https://t.me/cvenotify/3952 · Telegram Post