CVE-2021-21507
Dell EMC Networking X-Series firmware versions prior to 3.0.1.8 and Dell EMC PowerEdge VRTX Switch Module firmware versions prior to 2.0.0.82 contain a Weak Password Encryption Vulnerability.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.54%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Dell EMC Networking X-Series firmware versions prior to 3.0.1.8 and Dell EMC PowerEdge VRTX Switch Module firmware versions prior to 2.0.0.82 contain a Weak Password Encryption Vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability, leading to the disclosure of certain user credentials. The attacker may be able to use the exposed credentials to access the vulnerable system with privileges of the compromised account.
- CVSS 3.1
- 9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 0.54% probability · 44th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-261, CWE-326
- Affected
- dell/x1008p firmware · dell/x1018p firmware · dell/x1026p firmware · dell/x1052p firmware · dell/x4012 firmware · dell/r1-2401 firmware · dell/r1-2210 firmware · dell/x1008 firmware · dell/x1018 firmware · dell/x1026 firmware · dell/x1052 firmware
- Source
- security_alert@emc.com
References
- https://www.dell.com/support/kbdoc/000185252Patch, Vendor Advisory
- https://www.dell.com/support/kbdoc/000185252Patch, Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.