Hitachi Virtual File Platform Versions prior to 5.5.3-09 and Versions prior to 6.4.3-09, and NEC Storage M Series NAS Gateway Nh4a/Nh8a versions prior to FOS 5.5.3-08(NEC2.5.4a) and Nh4b/Nh8b, Nh4c/Nh8c versions prior to FOS 6.4.3-08(NEC3.4.2) allow remote authenticated attackers to execute arbitrary OS commands with root privileges via unspecified vectors.
References
| Link | Resource |
|---|---|
| https://jpn.nec.com/security-info/secinfo/nv21-011.html | Vendor Advisory |
| https://jvn.jp/en/jp/JVN21298724/index.html | Third Party Advisory |
| https://www.hitachi.co.jp/products/it/storage-solutions/global/sec_info/2021/2021_306.html | Vendor Advisory |
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
|
Configuration 3 (hide)
| AND |
|
Configuration 4 (hide)
| AND |
|
Configuration 5 (hide)
| AND |
|
Configuration 6 (hide)
| AND |
|
Configuration 7 (hide)
| AND |
|
Configuration 8 (hide)
| AND |
|
History
06 Jul 2021, 14:32
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-78 | |
| CVSS |
v2 : v3 : |
v2 : 9.0
v3 : 8.8 |
| CPE | cpe:2.3:h:nec:nas_gateway_nh8b:-:*:*:*:*:*:*:* cpe:2.3:o:nec:nas_gateway_nh8a_firmware:*:*:*:*:*:*:*:* cpe:2.3:o:nec:nas_gateway_nh4a_firmware:*:*:*:*:*:*:*:* cpe:2.3:a:hitachi:virtual_file_platform:*:*:*:*:*:*:*:* cpe:2.3:o:nec:nas_gateway_nh4b_firmware:*:*:*:*:*:*:*:* cpe:2.3:h:nec:nas_gateway_nh4b:-:*:*:*:*:*:*:* cpe:2.3:h:nec:nas_gateway_nh8a:-:*:*:*:*:*:*:* cpe:2.3:o:nec:nas_gateway_nh8b_firmware:*:*:*:*:*:*:*:* cpe:2.3:h:nec:nas_gateway_nh4c:-:*:*:*:*:*:*:* cpe:2.3:o:nec:nas_gateway_nh8c_firmware:*:*:*:*:*:*:*:* cpe:2.3:h:nec:nas_gateway_nh8c:-:*:*:*:*:*:*:* cpe:2.3:o:nec:nas_gateway_nh4c_firmware:*:*:*:*:*:*:*:* cpe:2.3:h:nec:nas_gateway_nh4a:-:*:*:*:*:*:*:* |
|
| References | (MISC) https://jpn.nec.com/security-info/secinfo/nv21-011.html - Vendor Advisory | |
| References | (MISC) https://www.hitachi.co.jp/products/it/storage-solutions/global/sec_info/2021/2021_306.html - Vendor Advisory | |
| References | (MISC) https://jvn.jp/en/jp/JVN21298724/index.html - Third Party Advisory |
28 Jun 2021, 02:35
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2021-06-28 01:15
Updated : 2023-12-10 13:55
NVD link : CVE-2021-20740
Mitre link : CVE-2021-20740
CVE.ORG link : CVE-2021-20740
JSON object : View
Products Affected
nec
- nas_gateway_nh4b_firmware
- nas_gateway_nh8a
- nas_gateway_nh8c
- nas_gateway_nh4c
- nas_gateway_nh4b
- nas_gateway_nh8b_firmware
- nas_gateway_nh4a
- nas_gateway_nh8c_firmware
- nas_gateway_nh8b
- nas_gateway_nh8a_firmware
- nas_gateway_nh4c_firmware
- nas_gateway_nh4a_firmware
hitachi
- virtual_file_platform
CWE
CWE-78
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')