PT-2021-23685 · Broadcom · Emulex Hba Manager/One Command Manager

Published 2021-11-12 · Updated 2021-11-15 · CVE-2021-42775

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions Broadcom Emulex HBA Manager/One Command Manager versions before 11.4.425.0 Broadcom Emulex HBA Manager/One Command Manager versions before 12.8.542.31

Description The issue is related to the remote firmware download feature, which could allow a user to place or replace an arbitrary file on the remote host. This is possible when the software is not installed in Strictly Local Management mode. In non-secure mode, the user exploiting this issue is unauthenticated.

Recommendations For versions before 11.4.425.0, update to version 11.4.425.0 or later. For versions before 12.8.542.31, update to version 12.8.542.31 or later. As a temporary workaround, consider installing the software in Strictly Local Management mode to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2021-42775

Affected Products

Emulex Hba Manager/One Command Manager

References · 5

• https://osv.dev/vulnerability/CVE-2021-42775 · Vendor Advisory
• https://docs.broadcom.com/doc/elx_HBAManager-Lin-RN12811-101.pdf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-42775 · Security Note
• https://broadcom.com/products/storage/fibre-channel-host-bus-adapters/emulex-hba-manager · Note
• https://t.me/cvenotify/23302 · Telegram Post