CVE-2023-43042: high-severity vulnerability in IBM Storage Virtualize
IBM Storage Virtualize information disclosure
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
IBM storage systems come with default passwords for privileged accounts that are never changed during setup, allowing unauthorized access to critical storage infrastructure.
The vulnerability stems from hardcoded default credentials for elevated user accounts in IBM SAN Volume Controller, Storwize, FlashSystem, and Storage Virtualize 8.3. An attacker with network access to the management interface can authenticate using these publicly known defaults, gaining privileged control over storage resources and sensitive data.
In the same product, most dangerous first.