CVE-2024-13058mediumCWE-269CWE-285CWE-400

CVE-2024-13058: medium-severity vulnerability in SoftIron HyperCloud

Authenticated, non-admin users can create storage pools via the sifi API

Published · Updated

Follow this CVE+ Monitor HyperCloud

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 4.8epss 0.4%
An issue exists in SoftIron HyperCloud where authenticated, but non-admin users can create data pools, which could potentially impact the performance and availability of the backend software-defined storage subsystem. This issue only impacts SoftIron HyperCloud and related software products (such as VM Squared) software versions 2.3.0 to before 2.5.0.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:N/SI:N/SA:L/S:N/AU:Y/R:U/V:D/RE:M/U:Green
Affected products
SoftIron · HyperCloud
Related CVEs — SoftIron HyperCloud

In the same product, most dangerous first.

CVE-2026-116755HIGHSoftIron HyperCloud: OS Command Injection in Orchestrator via Virtual Machine Template FieldsEPSS 0.9%CVE-2026-1842MEDIUMHyperCloud Improper Refresh Token Validation and Access Token Invalidation Allows Long-Term Unauthorized AccessEPSS 0.2%CVE-2023-45083MEDIUMHyperCloud: "admin" and "serveradmin" users can be deletedEPSS 0.2%CVE-2023-45084HIGHMedia caddy removal and reinsertion without reboot may cause data lossEPSS 0.2%CVE-2023-45085LOWWhen compute hosts are disabled and reenabled, they immediately transition to "ON", not "INIT"EPSS 0.2%CVE-2025-10650LOWImproper SSH Key Handling in Internal Debug Builds May Grant Cluster-Level Access to Non-Administrative UsersEPSS 0.1%