CVE-2020-5684

low-risk

Published 2020-12-24

iSM client versions from V5.1 prior to V12.1 running on NEC Storage Manager or NEC Storage Manager Express does not verify a server certificate properly, which allows a man-in-the-middle attacker to eavesdrop on an encrypted communication or alter the communication via a crafted certificate.

Do I need to act?

0.10% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 4.8/10 Medium

NETWORK / HIGH complexity

Affected Products (1)

Ism Server

Affected Vendors

Nec

References (4)

Vendor Advisory https://jpn.nec.com/security-info/secinfo/nv20-015.html

Third Party Advisory https://jvn.jp/en/jp/JVN10100024/index.html

Vendor Advisory https://jpn.nec.com/security-info/secinfo/nv20-015.html

Third Party Advisory https://jvn.jp/en/jp/JVN10100024/index.html

/ 100

low-risk

Severity 15/34 · Moderate

Exploitability 0/34 · Minimal

Exposure 5/34 · Minimal