CVE-2019-5490 : Certain versions between 2.x to 5.x (refer to advisory) of the NetApp Service Processor firmware were shipped with a def

Certain versions between 2.x to 5.x (refer to advisory) of the NetApp Service Processor firmware were shipped with a default account enabled that could allow unauthorized arbitrary command execution. Any platform listed in the advisory Impact section may be affected and should be upgraded to a fixed version of Service Processor firmware IMMEDIATELY.

Published 2019-03-21 19:29:01

Updated 2020-08-24 17:37:01

Source NetApp, Inc.

View at NVD, CVE.org

Exploit prediction scoring system (EPSS) score for CVE-2019-5490

EPSS FAQ

0.48%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 72 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2019-5490

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
10.0	HIGH	AV:N/AC:L/Au:N/C:C/I:C/A:C	10.0	10.0	NIST
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: Complete Integrity Impact: Complete Availability Impact: Complete
9.8	CRITICAL	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	3.9	5.9	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High

CWE ids for CVE-2019-5490

CWE-1188 Initialization of a Resource with an Insecure Default

The product initializes or sets a resource with a default that is intended to be changed by the administrator, but the default is not secure.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2019-5490

https://security.netapp.com/advisory/ntap-20190305-0001/

CVE-2019-5490 Default Privileged Account Vulnerability in the NetApp Service Processor | NetApp Product Security
Vendor Advisory
http://support.lenovo.com/us/en/solutions/LEN-26771

Default Privileged Account Vulnerability in the NetApp Service Processor - US

Products affected by CVE-2019-5490

Netapp » Service Processor » Version: 5.5
cpe:2.3:a:netapp:service_processor:5.5:-:*:*:*:*:*:*
Matching versions
When used together with: Netapp » Clustered Data Ontap » Version: 9.5
Netapp » Service Processor » Version: 4.5
cpe:2.3:a:netapp:service_processor:4.5:-:*:*:*:*:*:*
Matching versions
When used together with: Netapp » Clustered Data Ontap » Version: 9.5
Netapp » Service Processor » Version: 3.7
cpe:2.3:a:netapp:service_processor:3.7:-:*:*:*:*:*:*
Matching versions
When used together with: Netapp » Clustered Data Ontap » Version: 9.5
Netapp » Service Processor » Version: 2.8
cpe:2.3:a:netapp:service_processor:2.8:-:*:*:*:*:*:*
Matching versions
When used together with: Netapp » Clustered Data Ontap » Version: 9.5
Netapp » Service Processor » Version: 5.2 Update Patch1
cpe:2.3:a:netapp:service_processor:5.2:patch1:*:*:*:*:*:*
Matching versions
When used together with: Netapp » Clustered Data Ontap » Version: 9.2
Netapp » Service Processor » Version: 5.2
cpe:2.3:a:netapp:service_processor:5.2:-:*:*:*:*:*:*
Matching versions
When used together with: Netapp » Clustered Data Ontap » Version: 9.2
Netapp » Service Processor » Version: 4.2 Update Patch2
cpe:2.3:a:netapp:service_processor:4.2:patch2:*:*:*:*:*:*
Matching versions
When used together with: Netapp » Clustered Data Ontap » Version: 9.2
Netapp » Service Processor » Version: 4.2 Update Patch1
cpe:2.3:a:netapp:service_processor:4.2:patch1:*:*:*:*:*:*
Matching versions
When used together with: Netapp » Clustered Data Ontap » Version: 9.2
Netapp » Service Processor » Version: 2.5
cpe:2.3:a:netapp:service_processor:2.5:-:*:*:*:*:*:*
Matching versions
When used together with: Netapp » Clustered Data Ontap » Version: 9.2
Netapp » Service Processor » Version: 4.2
cpe:2.3:a:netapp:service_processor:4.2:-:*:*:*:*:*:*
Matching versions
When used together with: Netapp » Clustered Data Ontap » Version: 9.2
Netapp » Service Processor » Version: 3.4 Update Patch2
cpe:2.3:a:netapp:service_processor:3.4:patch2:*:*:*:*:*:*
Matching versions
When used together with: Netapp » Clustered Data Ontap » Version: 9.2
Netapp » Service Processor » Version: 3.4 Update Patch1
cpe:2.3:a:netapp:service_processor:3.4:patch1:*:*:*:*:*:*
Matching versions
When used together with: Netapp » Clustered Data Ontap » Version: 9.2
Netapp » Service Processor » Version: 3.4
cpe:2.3:a:netapp:service_processor:3.4:-:*:*:*:*:*:*
Matching versions
When used together with: Netapp » Clustered Data Ontap » Version: 9.2
Netapp » Service Processor » Version: 4.1 Update Patch5
cpe:2.3:a:netapp:service_processor:4.1:patch5:*:*:*:*:*:*
Matching versions
When used together with: Netapp » Clustered Data Ontap » Version: 9.1
Netapp » Service Processor » Version: 4.1 Update Patch4
cpe:2.3:a:netapp:service_processor:4.1:patch4:*:*:*:*:*:*
Matching versions
When used together with: Netapp » Clustered Data Ontap » Version: 9.1
Netapp » Service Processor » Version: 3.3 Update Patch1
cpe:2.3:a:netapp:service_processor:3.3:patch1:*:*:*:*:*:*
Matching versions
When used together with: Netapp » Clustered Data Ontap » Version: 9.1
Netapp » Service Processor » Version: 3.3
cpe:2.3:a:netapp:service_processor:3.3:-:*:*:*:*:*:*
Matching versions
When used together with: Netapp » Clustered Data Ontap » Version: 9.1
Netapp » Service Processor » Version: 5.1
cpe:2.3:a:netapp:service_processor:5.1:-:*:*:*:*:*:*
Matching versions
When used together with: Netapp » Clustered Data Ontap » Version: 9.1
Netapp » Service Processor » Version: 4.1 Update Patch6
cpe:2.3:a:netapp:service_processor:4.1:patch6:*:*:*:*:*:*
Matching versions
When used together with: Netapp » Clustered Data Ontap » Version: 9.1
Netapp » Service Processor » Version: 3.3 Update Patch4
cpe:2.3:a:netapp:service_processor:3.3:patch4:*:*:*:*:*:*
Matching versions
When used together with: Netapp » Clustered Data Ontap » Version: 9.1
Netapp » Service Processor » Version: 3.3 Update Patch3
cpe:2.3:a:netapp:service_processor:3.3:patch3:*:*:*:*:*:*
Matching versions
When used together with: Netapp » Clustered Data Ontap » Version: 9.1
Netapp » Service Processor » Version: 3.3 Update Patch2
cpe:2.3:a:netapp:service_processor:3.3:patch2:*:*:*:*:*:*
Matching versions
When used together with: Netapp » Clustered Data Ontap » Version: 9.1
Netapp » Service Processor » Version: 5.1 Update Patch3
cpe:2.3:a:netapp:service_processor:5.1:patch3:*:*:*:*:*:*
Matching versions
When used together with: Netapp » Clustered Data Ontap » Version: 9.1
Netapp » Service Processor » Version: 4.1 Update Patch3
cpe:2.3:a:netapp:service_processor:4.1:patch3:*:*:*:*:*:*
Matching versions
When used together with: Netapp » Clustered Data Ontap » Version: 9.1
Netapp » Service Processor » Version: 4.1 Update Patch2
cpe:2.3:a:netapp:service_processor:4.1:patch2:*:*:*:*:*:*
Matching versions
When used together with: Netapp » Clustered Data Ontap » Version: 9.1
Netapp » Service Processor » Version: 2.4.1 Update Patch1
cpe:2.3:a:netapp:service_processor:2.4.1:patch1:*:*:*:*:*:*
Matching versions
When used together with: Netapp » Clustered Data Ontap » Version: 9.1
Netapp » Service Processor » Version: 2.4.1
cpe:2.3:a:netapp:service_processor:2.4.1:-:*:*:*:*:*:*
Matching versions
When used together with: Netapp » Clustered Data Ontap » Version: 9.1
Netapp » Service Processor » Version: 5.1 Update Patch2
cpe:2.3:a:netapp:service_processor:5.1:patch2:*:*:*:*:*:*
Matching versions
When used together with: Netapp » Clustered Data Ontap » Version: 9.1
Netapp » Service Processor » Version: 5.1 Update Patch1
cpe:2.3:a:netapp:service_processor:5.1:patch1:*:*:*:*:*:*
Matching versions
When used together with: Netapp » Clustered Data Ontap » Version: 9.1
Netapp » Service Processor » Version: 4.1 Update Patch1
cpe:2.3:a:netapp:service_processor:4.1:patch1:*:*:*:*:*:*
Matching versions
When used together with: Netapp » Clustered Data Ontap » Version: 9.1
Netapp » Service Processor » Version: 4.1
cpe:2.3:a:netapp:service_processor:4.1:-:*:*:*:*:*:*
Matching versions
When used together with: Netapp » Clustered Data Ontap » Version: 9.1
Netapp » Service Processor » Version: 3.2
cpe:2.3:a:netapp:service_processor:3.2:-:*:*:*:*:*:*
Matching versions
When used together with: Netapp » Clustered Data Ontap » Version: 9.0
Netapp » Service Processor » Version: 2.4
cpe:2.3:a:netapp:service_processor:2.4:-:*:*:*:*:*:*
Matching versions
When used together with: Netapp » Clustered Data Ontap » Version: 9.0
Netapp » Service Processor » Version: 3.1.2
cpe:2.3:a:netapp:service_processor:3.1.2:-:*:*:*:*:*:*
Matching versions
When used together with: Netapp » Clustered Data Ontap » Version: 8.3
Netapp » Service Processor » Version: 2.3.2 Update Patch3
cpe:2.3:a:netapp:service_processor:2.3.2:patch3:*:*:*:*:*:*
Matching versions
When used together with: Netapp » Clustered Data Ontap » Version: 8.3
Netapp » Service Processor » Version: 3.1.2 Update Patch2
cpe:2.3:a:netapp:service_processor:3.1.2:patch2:*:*:*:*:*:*
Matching versions
When used together with: Netapp » Clustered Data Ontap » Version: 8.3
Netapp » Service Processor » Version: 3.1.2 Update Patch1
cpe:2.3:a:netapp:service_processor:3.1.2:patch1:*:*:*:*:*:*
Matching versions
When used together with: Netapp » Clustered Data Ontap » Version: 8.3
Netapp » Service Processor » Version: 2.3.2 Update Patch2
cpe:2.3:a:netapp:service_processor:2.3.2:patch2:*:*:*:*:*:*
Matching versions
When used together with: Netapp » Clustered Data Ontap » Version: 8.3
Netapp » Service Processor » Version: 2.3.2 Update Patch1
cpe:2.3:a:netapp:service_processor:2.3.2:patch1:*:*:*:*:*:*
Matching versions
When used together with: Netapp » Clustered Data Ontap » Version: 8.3
Netapp » Service Processor » Version: 2.3.2
cpe:2.3:a:netapp:service_processor:2.3.2:-:*:*:*:*:*:*
Matching versions
When used together with: Netapp » Clustered Data Ontap » Version: 8.3
Netapp » Service Processor » Version: 3.0.4
cpe:2.3:a:netapp:service_processor:3.0.4:-:*:*:*:*:*:*
Matching versions
When used together with: Netapp » Clustered Data Ontap » Version: 8.2
Netapp » Service Processor » Version: 2.2.5
cpe:2.3:a:netapp:service_processor:2.2.5:-:*:*:*:*:*:*
Matching versions
When used together with: Netapp » Clustered Data Ontap » Version: 8.2

Vulnerability Details : CVE-2019-5490

Exploit prediction scoring system (EPSS) score for CVE-2019-5490

CVSS scores for CVE-2019-5490

CWE ids for CVE-2019-5490

References for CVE-2019-5490

Products affected by CVE-2019-5490