CVE-2021-32522: critical vulnerability in QSAN Storage Manager
QSAN Storage Manager, XEVO, SANOS - Improper Restriction of Excessive Authentication Attempts
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
The QSAN storage systems don't properly limit login attempts, allowing attackers to guess passwords through repeated attacks. This can lead to unauthorized access to critical storage systems.
CWE-307 vulnerability enabling brute force attacks against authentication mechanisms in QSAN Storage Manager, XEVO, and SANOS; remote attackers can enumerate valid credentials by making unlimited login attempts without rate limiting or account lockout protections, potentially compromising data confidentiality and integrity.
In the same product, most dangerous first.