CVE-2021-20740
High
Description
Hitachi Virtual File Platform Versions prior to 5.5.3-09 and Versions prior to 6.4.3-09, and NEC Storage M Series NAS Gateway Nh4a/Nh8a versions prior to FOS 5.5.3-08(NEC2.5.4a) and Nh4b/Nh8b, Nh4c/Nh8c versions prior to FOS 6.4.3-08(NEC3.4.2) allow remote authenticated attackers to execute arbitrary OS commands with root privileges via unspecified vectors.
SeverityHigh
CVSS8.8
Exploit probability—
ProductHitachi Virtual File Platform
PublishedJun 28, 2021
First seenJun 28, 2021
How to fix
Update
- hitachi virtual_file_platform6.4.3-09, 5.5.3-09 or later
- nec nas_gateway_nh4a_firmwarefos_5.5.3-08\(nec2.5.4a\) or later
- nec nas_gateway_nh8a_firmwarefos_5.5.3-08\(nec2.5.4a\) or later
- nec nas_gateway_nh4b_firmwarefos_6.4.3-08\(nec3.4.2\) or later
- nec nas_gateway_nh8b_firmwarefos_6.4.3-08\(nec3.4.2\) or later
- nec nas_gateway_nh4c_firmwarefos_6.4.3-08\(nec3.4.2\) or later
- nec nas_gateway_nh8c_firmwarefos_6.4.3-08\(nec3.4.2\) or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| hitachi virtual_file_platform | v < 6.4.3-09, v < 5.5.3-09 | 6.4.3-09, 5.5.3-09 |
| nec nas_gateway_nh4a_firmware | v < fos_5.5.3-08\(nec2.5.4a\) | fos_5.5.3-08\(nec2.5.4a\) |
| nec nas_gateway_nh8a_firmware | v < fos_5.5.3-08\(nec2.5.4a\) | fos_5.5.3-08\(nec2.5.4a\) |
| nec nas_gateway_nh4b_firmware | v < fos_6.4.3-08\(nec3.4.2\) | fos_6.4.3-08\(nec3.4.2\) |
| nec nas_gateway_nh8b_firmware | v < fos_6.4.3-08\(nec3.4.2\) | fos_6.4.3-08\(nec3.4.2\) |
| nec nas_gateway_nh4c_firmware | v < fos_6.4.3-08\(nec3.4.2\) | fos_6.4.3-08\(nec3.4.2\) |
| nec nas_gateway_nh8c_firmware | v < fos_6.4.3-08\(nec3.4.2\) | fos_6.4.3-08\(nec3.4.2\) |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.