What is CVE-2019-5490?

CVE-2019-5490 is a critical-severity vulnerability in NetApp Clustered Data Ontap, classified under Initialization of a Resource with an Insecure Default. CVSS score: 9.8/10. Published 2019-03-21.

How severe is CVE-2019-5490?

Critical severity. CVSS v3 base score is 9.8 out of 10.

RCE in NetApp Clustered Data Ontap

CVE-2019-5490

Certain versions between 2.x to 5.x (refer to advisory) of the NetApp Service Processor firmware were shipped with a default account enabled that could allow unauthorized arbitrary command execution. Any platform listed in the advisory Impact section may be affected and should be upgraded to a fixed version of Service Processor firmware IMMEDIATELY.

Published 2019-03-21 · last modified 2026-06-17.

CVSS v3 metric

CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

EPSS exploit prediction

EPSS: 0.035 (89.0th percentile), scored 2026-10-19.

Low probability of exploitation in the next 30 days, but still tracked. 89th percentile — 89.0% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.035 · newest: 0.035 · change: 0.000

Affected products

NetApp Clustered Data Ontap — versions 9.5, 9.4, 9.3
NetApp Service Processor — versions 2.8, 3.7, 4.5
NetApp, Inc. NetApp Service Processor — versions 2.x-5.x - refer to advisory

Weakness classification (CWE)

CWE-1188 — Initialization of a Resource with an Insecure Default

References

security.netapp.com/advisory/ntap-20190305-0001/ (Vendor Advisory)
support.lenovo.com/us/en/solutions/LEN-26771

Frequently asked questions

What is CVE-2019-5490?: CVE-2019-5490 is a critical-severity vulnerability in NetApp Clustered Data Ontap, classified under Initialization of a Resource with an Insecure Default. CVSS score: 9.8/10. Published 2019-03-21.
How severe is CVE-2019-5490?: Critical severity. CVSS v3 base score is 9.8 out of 10.