CVE-2020-5372 : Dell EMC PowerStore versions prior to 1.0.1.0.5.002 contain a vulnerability that

Dell EMC PowerStore versions prior to 1.0.1.0.5.002 contain a vulnerability that exposes test interface ports to external network. A remote unauthenticated attacker could potentially cause Denial of Service via test interface ports which are not used during run time environment.

Published 2020-07-06 18:15:21

Updated 2020-07-13 14:16:03

Source Dell

View at NVD, CVE.org

Vulnerability category: Denial of service

Products affected by CVE-2020-5372

Dell » Emc Powerstore 1000 Firmware
Versions before (<) 1.0.1.0.5.002
cpe:2.3:o:dell:emc_powerstore_1000_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Emc Powerstore 1000 » Version: N/A
Dell » Emc Powerstore 3000 Firmware
Versions before (<) 1.0.1.0.5.002
cpe:2.3:o:dell:emc_powerstore_3000_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Emc Powerstore 3000 » Version: N/A
Dell » Emc Powerstore 5000 Firmware
Versions before (<) 1.0.1.0.5.002
cpe:2.3:o:dell:emc_powerstore_5000_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Emc Powerstore 5000 » Version: N/A
Dell » Emc Powerstore 7000 Firmware
Versions before (<) 1.0.1.0.5.002
cpe:2.3:o:dell:emc_powerstore_7000_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Emc Powerstore 7000 » Version: N/A
Dell » Emc Powerstore 9000 Firmware
Versions before (<) 1.0.1.0.5.002
cpe:2.3:o:dell:emc_powerstore_9000_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Dell » Emc Powerstore 9000 » Version: N/A

Exploit prediction scoring system (EPSS) score for CVE-2020-5372

EPSS FAQ

0.18%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 55 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2020-5372

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
5.0	MEDIUM	AV:N/AC:L/Au:N/C:N/I:N/A:P	10.0	2.9	NIST
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: None Integrity Impact: None Availability Impact: Partial
7.5	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	3.9	3.6	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: None Integrity: None Availability: High
8.6	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H	3.9	4.7	Dell
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: Low Integrity: Low Availability: High

CWE ids for CVE-2020-5372

CWE-863 Incorrect Authorization

The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Assigned by: nvd@nist.gov (Primary)
CWE-1244 Internal Asset Exposed to Unsafe Debug Access Level or State

The product uses physical debug or test interfaces with support for multiple access levels, but it assigns the wrong debug access level to an internal asset, providing unintended access to the asset from untrusted debug agents.

Assigned by: security_alert@emc.com (Secondary)

References for CVE-2020-5372

https://www.dell.com/support/security/en-us/details/544738/DSA-2020-159-Dell-EMC-PowerStore-Family-Improper-Authorization-Vulnerability

Access Denied
Vendor Advisory

Jump to

Vulnerability Details : CVE-2020-5372

Products affected by CVE-2020-5372

Exploit prediction scoring system (EPSS) score for CVE-2020-5372

CVSS scores for CVE-2020-5372

CWE ids for CVE-2020-5372

References for CVE-2020-5372