IBM Storage Virtualize information disclosure
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 7.5epss 0.7%
exploitation probability
0.7%top 48% of all CVEs
observed exploitation
nono source reports it
In short
IBM storage systems come with default passwords for privileged accounts that are never changed during setup, allowing unauthorized access to critical storage infrastructure.
Technical detail
The vulnerability stems from hardcoded default credentials for elevated user accounts in IBM SAN Volume Controller, Storwize, FlashSystem, and Storage Virtualize 8.3. An attacker with network access to the management interface can authenticate using these publicly known defaults, gaining privileged control over storage resources and sensitive data.
Summary generated and translated by AI from the official description.
IBM SAN Volume Controller, IBM Storwize, IBM FlashSystem and IBM Storage Virtualize 8.3 products use default passwords for a privileged user. IBM X-Force ID: 266874.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected products
IBM · Storage Virtualize