PT-2021-23684 · Broadcom · Emulex Hba Manager/One Command Manager

Published 2021-11-12 · Updated 2021-11-15 · CVE-2021-42774

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Broadcom Emulex HBA Manager/One Command Manager versions before 11.4.425.0 Broadcom Emulex HBA Manager/One Command Manager versions before 12.8.542.31

Description The issue is related to a buffer overflow vulnerability in the remote firmware download feature. This could allow remote unauthenticated users to perform various attacks, particularly when the software is not installed in Strictly Local Management mode. In non-secure mode, users are considered unauthenticated.

Recommendations For versions before 11.4.425.0, update to version 11.4.425.0 or later to resolve the issue. For versions before 12.8.542.31, update to version 12.8.542.31 or later to resolve the issue. As a temporary workaround, consider installing the software in Strictly Local Management mode to minimize the risk of exploitation.

Fix

Buffer Overflow

Weakness Enumeration

CWE-120

Related Identifiers

CVE-2021-42774

Affected Products

Emulex Hba Manager/One Command Manager

References · 5

• https://osv.dev/vulnerability/CVE-2021-42774 · Vendor Advisory
• https://docs.broadcom.com/doc/elx_HBAManager-Lin-RN12811-101.pdf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-42774 · Security Note
• https://broadcom.com/products/storage/fibre-channel-host-bus-adapters/emulex-hba-manager · Note
• https://t.me/cvenotify/23303 · Telegram Post