PT-2021-4894 · Dell Emc · Dell Emc Insightiq

Published 2021-09-17 · Updated 2021-10-08 · CVE-2021-36298

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Dell EMC InsightIQ versions prior to 4.1.4

Description The issue is related to the use of risky cryptographic algorithms in the SSH component of Dell EMC InsightIQ. A remote unauthenticated attacker could potentially exploit this, leading to authentication bypass and remote takeover of InsightIQ. This allows an attacker to take complete control of InsightIQ, affecting services provided by SSH.

Recommendations For versions prior to 4.1.4, upgrade to version 4.1.4 or later at the earliest opportunity to resolve the issue. As a temporary workaround, consider restricting access to the SSH component until the upgrade is applied.

Fix

Use of a Broken Cryptographic Algorithm

Weakness Enumeration

CWE-327

Related Identifiers

BDU:2021-05629

CVE-2021-36298

Affected Products

Dell Emc Insightiq

References · 11

• https://bdu.fstec.ru/vul/2021-05629 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-36298 · Security Note
• https://dell.com/support/kbdoc/000191604 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-36298 · Vendor Advisory
• https://t.me/cvenotify/21845 · Telegram Post
• https://cybersecurity-help.cz/vdb/SB2021092110 · Note
• https://vuldb.com/?id.183711 · Note
• https://t.me/cvenotify/21795 · Telegram Post
• https://t.me/cibsecurity/29849 · Telegram Post
• https://t.me/cvenotify/22126 · Telegram Post
• https://dell.com/support/kbdoc/ru-ru/printview/000191604/10/en · Note