Paper/Archive/CVE-2024-22216

CVE-2024-22216

mitre — In default installations of Microchip maxView Storage Manager (for Adaptec Smart Storage Controllers) where Redfish server is configured…

EPSS 0.5%CVSS 10.0

critical.is priorityof 100

CVSS 10.0 (NVD)10.0 / 10 × 3030.0 Not in CISA KEV+300.0 EPSS percentile 44.7.447 × 208.9 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

In default installations of Microchip maxView Storage Manager (for Adaptec Smart Storage Controllers) where Redfish server is configured for remote system management, unauthorized access can occur, with data modification and information disclosure. This affects 3.00.23484 through 4.14.00.26064 (except for the patched versions 3.07.23980 and 4.07.00.25339).

Affected

ProductAffectedFixed inSource

n/an/a–CNA

Scores by source

NVD10.0CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: partial

References

refmicrochip.com/en-us/solutions/embedded-security/how-to-report-potential-product-security-vulnerabilities/maxview-storage-manager-redfish-server-vulnerability