by Kastro
Paper/Archive/CVE-2020-29127

CVE-2020-29127

mitre — An issue was discovered on Fujitsu Eternus Storage DX200 S4 devices through 2020-11-25.

EPSS 4%CVSS 9.8
critical.is priorityof 100
48
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 91.5.915 × 2018.3No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

An issue was discovered on Fujitsu Eternus Storage DX200 S4 devices through 2020-11-25. After logging into the portal as a root user (using any web browser), the portal can be accessed with root privileges when the URI cgi-bin/csp?cspid={XXXXXXXXXX}&csppage=cgi_PgOverview&csplang=en is visited from a different web browser.

Affected

ProductAffectedFixed inSource
n/an/a–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

reffirst.org/members/teams/fujitsu_psirtrefpacketstormsecurity.com/files/160255/Fujitsu-Eternus-Storage-DX200-S4-Broken-Authentication.htmlrefcxsecurity.com/issue/WLB-2020110215refseccops.com/fujitsu-eternus-storage-dx200-s4-broken-authentication