CVE-2021-26588 : A potential security vulnerability has been identified in HPE 3PAR StoreServ, HP

A potential security vulnerability has been identified in HPE 3PAR StoreServ, HPE Primera Storage and HPE Alletra 9000 Storage array firmware. An unauthenticated user could remotely exploit the low complexity issue to execute code as administrator. This vulnerability impacts completely the confidentiality, integrity, availability of the array. HPE has made the following software updates and mitigation information to resolve the vulnerability in 3PAR, Primera and Alletra 9000 firmware.

Published 2021-10-11 17:15:08

Updated 2021-10-18 17:52:39

Source Hewlett Packard Enterprise (HPE)

View at NVD, CVE.org

Vulnerability category: Execute code

Products affected by CVE-2021-26588

HPE » 3par Os » Version: 3.3.1 Mp5 P156
cpe:2.3:o:hpe:3par_os:3.3.1_mp5_p156:*:*:*:*:*:*:*
Matching versions
When used together with: HPE » 3par Storeserv 10400 » Version: N/A
When used together with: HPE » 3par Storeserv 10800 » Version: N/A
When used together with: HPE » 3par Storeserv 20000 » Version: N/A
When used together with: HPE » 3par Storeserv 7200c » Version: N/A
When used together with: HPE » 3par Storeserv 7400c » Version: N/A
When used together with: HPE » 3par Storeserv 7440c » Version: N/A
When used together with: HPE » 3par Storeserv 8000 » Version: N/A
When used together with: HPE » 3par Storeserv 9000 » Version: N/A
HPE » 3par Os » Version: 3.3.1 Mu1
cpe:2.3:o:hpe:3par_os:3.3.1_mu1:*:*:*:*:*:*:*
Matching versions
When used together with: HPE » 3par Storeserv 10400 » Version: N/A
When used together with: HPE » 3par Storeserv 10800 » Version: N/A
When used together with: HPE » 3par Storeserv 20000 » Version: N/A
When used together with: HPE » 3par Storeserv 7200c » Version: N/A
When used together with: HPE » 3par Storeserv 7400c » Version: N/A
When used together with: HPE » 3par Storeserv 7440c » Version: N/A
When used together with: HPE » 3par Storeserv 8000 » Version: N/A
When used together with: HPE » 3par Storeserv 9000 » Version: N/A
HPE » 3par Os » Version: 3.3.1 Mu2 P157
cpe:2.3:o:hpe:3par_os:3.3.1_mu2_p157:*:*:*:*:*:*:*
Matching versions
When used together with: HPE » 3par Storeserv 10400 » Version: N/A
When used together with: HPE » 3par Storeserv 10800 » Version: N/A
When used together with: HPE » 3par Storeserv 20000 » Version: N/A
When used together with: HPE » 3par Storeserv 7200c » Version: N/A
When used together with: HPE » 3par Storeserv 7400c » Version: N/A
When used together with: HPE » 3par Storeserv 7440c » Version: N/A
When used together with: HPE » 3par Storeserv 8000 » Version: N/A
When used together with: HPE » 3par Storeserv 9000 » Version: N/A
HPE » 3par Os » Version: 3.3.2 Ga P 01
cpe:2.3:o:hpe:3par_os:3.3.2_ga_p_01:*:*:*:*:*:*:*
Matching versions
When used together with: HPE » 3par Storeserv 10400 » Version: N/A
When used together with: HPE » 3par Storeserv 10800 » Version: N/A
When used together with: HPE » 3par Storeserv 20000 » Version: N/A
When used together with: HPE » 3par Storeserv 7200c » Version: N/A
When used together with: HPE » 3par Storeserv 7400c » Version: N/A
When used together with: HPE » 3par Storeserv 7440c » Version: N/A
When used together with: HPE » 3par Storeserv 8000 » Version: N/A
When used together with: HPE » 3par Storeserv 9000 » Version: N/A
HPE » Primera 630 Firmware
Versions from including (>=) 4.0.0 and up to, including, (<=) 4.3.3
cpe:2.3:o:hpe:primera_630_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: HPE » Primera 630 » Version: N/A
HPE » Primera 650 Firmware
Versions from including (>=) 4.0.0 and up to, including, (<=) 4.3.3
cpe:2.3:o:hpe:primera_650_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: HPE » Primera 650 » Version: N/A
HPE » Primera 670 Firmware
Versions from including (>=) 4.0.0 and up to, including, (<=) 4.3.3
cpe:2.3:o:hpe:primera_670_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: HPE » Primera 670 » Version: N/A
HPE » Alletra 9060 Firmware
Versions from including (>=) 9.3.0 and up to, including, (<=) 9.4.0
cpe:2.3:o:hpe:alletra_9060_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: HPE » Alletra 9060 » Version: N/A
HPE » Alletra 9080 Firmware
Versions from including (>=) 9.3.0 and up to, including, (<=) 9.4.0
cpe:2.3:o:hpe:alletra_9080_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: HPE » Alletra 9080 » Version: N/A

Exploit prediction scoring system (EPSS) score for CVE-2021-26588

EPSS FAQ

1.71%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 81 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2021-26588

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
10.0	HIGH	AV:N/AC:L/Au:N/C:C/I:C/A:C	10.0	10.0	NIST
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: Complete Integrity Impact: Complete Availability Impact: Complete
9.8	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	3.9	5.9	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High

References for CVE-2021-26588

https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst04191en_us

Document - HPESBST04191 rev.2 - HPE 3PAR StoreServ, HPE Primera Storage and HPE Alletra 9000 Storage Arrays, Remote Unauthenticated Code Execution | HPE Support
Vendor Advisory

Jump to

Vulnerability Details : CVE-2021-26588

Products affected by CVE-2021-26588

Exploit prediction scoring system (EPSS) score for CVE-2021-26588

CVSS scores for CVE-2021-26588

References for CVE-2021-26588