CVE-2021-20740

moderate-risk

Published 2021-06-28

Hitachi Virtual File Platform Versions prior to 5.5.3-09 and Versions prior to 6.4.3-09, and NEC Storage M Series NAS Gateway Nh4a/Nh8a versions prior to FOS 5.5.3-08(NEC2.5.4a) and Nh4b/Nh8b, Nh4c/Nh8c versions prior to FOS 6.4.3-08(NEC3.4.2) allow remote authenticated attackers to execute arbitrary OS commands with root privileges via unspecified vectors.

Do I need to act?

2.4% chance of exploitation in next 30 days

EPSS score — moderate exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 8.8/10 High

NETWORK / LOW complexity

Affected Products (7)

Virtual File Platform

Nas Gateway Nh4A Firmware

Nas Gateway Nh8A Firmware

Nas Gateway Nh4B Firmware

Nas Gateway Nh8B Firmware

Nas Gateway Nh4C Firmware

Nas Gateway Nh8C Firmware

Affected Vendors

Nec Hitachi

References (6)

Vendor Advisory https://jpn.nec.com/security-info/secinfo/nv21-011.html

Third Party Advisory https://jvn.jp/en/jp/JVN21298724/index.html

Vendor Advisory https://www.hitachi.co.jp/products/it/storage-solutions/global/sec_info/2021/202...

Vendor Advisory https://jpn.nec.com/security-info/secinfo/nv21-011.html

Third Party Advisory https://jvn.jp/en/jp/JVN21298724/index.html

Vendor Advisory https://www.hitachi.co.jp/products/it/storage-solutions/global/sec_info/2021/202...

/ 100

moderate-risk

Severity 30/34 · Critical

Exploitability 5/34 · Minimal

Exposure 14/34 · Moderate