PT-2021-12471 · Nec · Nec Express5800/T110J+2

Published 2021-01-13 · Updated 2021-01-21 · CVE-2020-5633

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: NEC Express5800/T110j versions with Baseboard Management Controller (BMC) firmware Rev1.09 and earlier NEC Express5800/T110j-S versions with Baseboard Management Controller (BMC) firmware Rev1.09 and earlier NEC Express5800/T110j (2nd-Gen) versions with Baseboard Management Controller (BMC) firmware Rev1.09 and earlier NEC Express5800/T110j-S (2nd-Gen) versions with Baseboard Management Controller (BMC) firmware Rev1.09 and earlier NEC iStorage NS100Ti versions with Baseboard Management Controller (BMC) firmware Rev1.09 and earlier NEC Express5800/GT110j versions with Baseboard Management Controller (BMC) firmware Rev1.09 and earlier

Description: The issue allows remote attackers to bypass authentication and then obtain or modify Baseboard Management Controller (BMC) setting information, obtain monitoring information, or reboot or shut down the vulnerable product via unspecified vectors.

Recommendations: For NEC Express5800/T110j with Baseboard Management Controller (BMC) firmware Rev1.09 and earlier, update the BMC firmware to a version later than Rev1.09. For NEC Express5800/T110j-S with Baseboard Management Controller (BMC) firmware Rev1.09 and earlier, update the BMC firmware to a version later than Rev1.09. For NEC Express5800/T110j (2nd-Gen) with Baseboard Management Controller (BMC) firmware Rev1.09 and earlier, update the BMC firmware to a version later than Rev1.09. For NEC Express5800/T110j-S (2nd-Gen) with Baseboard Management Controller (BMC) firmware Rev1.09 and earlier, update the BMC firmware to a version later than Rev1.09. For NEC iStorage NS100Ti with Baseboard Management Controller (BMC) firmware Rev1.09 and earlier, update the BMC firmware to a version later than Rev1.09. For NEC Express5800/GT110j with Baseboard Management Controller (BMC) firmware Rev1.09 and earlier, update the BMC firmware to a version later than Rev1.09.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2020-5633

Affected Products

Nec Express5800/Gt110J

Nec Express5800/T110J

Nec Istorage Ns100Ti

References · 7

• https://jpn.nec.com/security-info/secinfo/nv21-002.html · Vendor Advisory
• https://support.nec.co.jp/View.aspx?id=9010108754 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-5633 · Security Note
• https://osv.dev/vulnerability/CVE-2020-5633 · Vendor Advisory
• https://jvn.jp/en/jp/JVN38752718/index.html · Note
• https://t.me/cvenotify/8831 · Telegram Post
• https://t.me/cvenotify/8466 · Telegram Post