PT-2022-15529 · Dell Emc · Dell Emc Powerscale Onefs

Published 2022-04-12 · Updated 2022-04-20 · CVE-2022-22560

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Name of the Vulnerable Software and Affected Versions Dell EMC PowerScale OneFS versions 8.1.x through 9.1.x

Description The issue concerns hard-coded credentials in the software, allowing a local user with knowledge of these credentials to login as the admin user to the backend ethernet switch of a PowerScale cluster. This can be exploited to take the switch offline.

Recommendations For versions 8.1.x through 9.1.x, consider changing the hardcoded credentials to unique, secure credentials to prevent unauthorized access to the backend ethernet switch. As a temporary workaround, restrict access to the switch to minimize the risk of exploitation.

Fix

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

CVE-2022-22560

Affected Products

Dell Emc Powerscale Onefs

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2022-22560 · Security Note
• https://osv.dev/vulnerability/CVE-2022-22560 · Vendor Advisory
• https://dell.com/support/kbdoc/000195815 · Vendor Advisory
• https://t.me/cibsecurity/40664 · Telegram Post