PT-2021-23683 · Broadcom · Broadcom Emulex Hba Manager/One Command Manager

Published 2021-11-12 · Updated 2022-07-12 · CVE-2021-42773

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Broadcom Emulex HBA Manager/One Command Manager versions before 11.4.425.0 Broadcom Emulex HBA Manager/One Command Manager versions before 12.8.542.31

Description The issue allows a user to retrieve an arbitrary file from a remote host using the GetDumpFile command. This can occur when the software is not installed in Strictly Local Management mode. In non-secure mode, the user exploiting this issue is unauthenticated.

Recommendations For versions before 11.4.425.0, update to version 11.4.425.0 or later. For versions before 12.8.542.31, update to version 12.8.542.31 or later. As a temporary workaround, consider installing the software in Strictly Local Management mode to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2021-42773

Affected Products

Broadcom Emulex Hba Manager/One Command Manager

References · 5

• https://osv.dev/vulnerability/CVE-2021-42773 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-42773 · Security Note
• https://docs.broadcom.com/doc/elx_HBAManager-Lin-RN12811-101.pdf · Vendor Advisory
• https://t.me/cvenotify/23304 · Telegram Post
• https://broadcom.com/products/storage/fibre-channel-host-bus-adapters/emulex-hba-manager · Note