PT-2021-12397 · Dell Emc · Dell Emc Data Protection Advisor

Published 2021-07-28 · Updated 2022-09-20 · CVE-2020-5351

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Dell EMC Data Protection Advisor versions 6.4, 6.5 and 18.1

Description The issue concerns an undocumented account with limited privileges that is protected with a hard-coded password. A remote unauthenticated malicious user with knowledge of the hard-coded password may login to the system and gain read-only privileges.

Recommendations For versions 6.4, 6.5, and 18.1, consider changing the hard-coded password of the undocumented account to a unique and secure password to prevent unauthorized access. As a temporary workaround, restrict access to the system to minimize the risk of exploitation until a more permanent solution is available. Avoid using the default configuration that includes the hard-coded password for the undocumented account.

Fix

Weakness Enumeration

CWE-259

Related Identifiers

CVE-2020-5351

Affected Products

Dell Emc Data Protection Advisor

References · 4

• https://dell.com/support/security/en-us/details/542649/DSA-2020-080-Dell-EMC-Data-Protection-Advisor-Hard-Coded-Credential-Vulnerability · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-5351 · Security Note
• https://osv.dev/vulnerability/CVE-2020-5351 · Vendor Advisory
• https://t.me/cvenotify/18216 · Telegram Post