CVE-2020-8573 : Security Advisory and Response

NetApp HCI Baseboard Management Controller (BMC) devices are affected by a default credential vulnerability that could lead to a Denial of Service (DoS) attack.

Understanding CVE-2020-8573

This CVE identifies a security issue in NetApp HCI Baseboard Management Controller (BMC) devices that could be exploited by remote attackers.

What is CVE-2020-8573?

The vulnerability arises from the devices being shipped with a default account and password, which are reset to the default values during specific upgrades, potentially enabling DoS attacks.

The Impact of CVE-2020-8573

The vulnerability allows remote attackers to exploit the default credentials to cause a Denial of Service (DoS) on the affected NetApp HCI BMC devices.

Technical Details of CVE-2020-8573

NetApp HCI Baseboard Management Controller (BMC) devices are affected by a default credential vulnerability that could lead to a Denial of Service (DoS) attack.

Vulnerability Description

The issue stems from the devices being shipped with a documented default account and password, which are reset to default values during specific upgrades, creating a security risk.

Affected Systems and Versions

Affected Products: NetApp HCI Baseboard Management Controller (BMC) HCI H610C, H615C, H610S
Vulnerable Versions: Element OS v11.8, Element OS v12.0, Compute Firmware Bundle v12.2.92

Exploitation Mechanism

The vulnerability allows remote attackers to exploit the default credentials on the affected NetApp HCI BMC devices, potentially leading to a Denial of Service (DoS) attack.

Mitigation and Prevention

Steps to address and prevent the CVE-2020-8573 vulnerability.

Immediate Steps to Take

Change the default account and password during the initial setup of NetApp HCI BMC devices.
Regularly update and patch the BMC firmware to mitigate the risk of default credential exploitation.

Long-Term Security Practices

Implement strong password policies and avoid using default credentials on any devices.
Conduct regular security audits and vulnerability assessments to identify and address potential security gaps.

Patching and Updates

NetApp has released updates to address the default credential vulnerability in the affected BMC devices. Ensure timely installation of these patches to secure the devices.