CVE-2019-5490
Critical
Description
Certain versions between 2.x to 5.x (refer to advisory) of the NetApp Service Processor firmware were shipped with a default account enabled that could allow unauthorized arbitrary command execution. Any platform listed in the advisory Impact section may be affected and should be upgraded to a fixed version of Service Processor firmware IMMEDIATELY.
SeverityCritical
CVSS9.8
Exploit probability—
ProductNetapp Service Processor
PublishedMar 21, 2019
First seenMar 21, 2019
How to fix
Sources list no fixed version or patch link for this vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| netapp service_processor | 2.8, 3.7, 4.5, 5.5, 2.5, 3.4, 4.2, 5.2, 2.4.1, 3.3, 4.1, 5.1, 2.4, 3.2, 2.3.2, 3.1.2, 2.2.5, 3.0.4 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.