What is CVE-2021-26588?

CVE-2021-26588 is a critical-severity vulnerability in HPE 3par OS. CVSS score: 9.8/10. Published 2021-10-11.

How severe is CVE-2021-26588?

Critical severity. CVSS v3 base score is 9.8 out of 10.

Vulnerability in HPE 3par OS

CVE-2021-26588

A potential security vulnerability has been identified in HPE 3PAR StoreServ, HPE Primera Storage and HPE Alletra 9000 Storage array firmware. An unauthenticated user could remotely exploit the low complexity issue to execute code as administrator. This vulnerability impacts completely the confidentiality, integrity, availability of the array. HPE has made the following software updates and mitigation information to resolve the vulnerability in 3PAR, Primera and Alletra 9000 firmware.

EPSS: 0.018 (75.6th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Affected products

Hpe 3par_os — versions 3.3.1_mp5_p156, 3.3.1_mu1, 3.3.1_mu2_p157
Hpe 3par_storeserv_10400
Hpe 3par_storeserv_10800
Hpe 3par_storeserv_20000
Hpe 3par_storeserv_7200c
Hpe 3par_storeserv_7400c
Hpe 3par_storeserv_7440c
Hpe 3par_storeserv_8000
Hpe 3par_storeserv_9000
Hpe Alletra_9060

References

security-alert@hpe.com (x_refsource_MISC, Vendor Advisory)

Frequently asked questions

What is CVE-2021-26588?: CVE-2021-26588 is a critical-severity vulnerability in HPE 3par OS. CVSS score: 9.8/10. Published 2021-10-11.
How severe is CVE-2021-26588?: Critical severity. CVSS v3 base score is 9.8 out of 10.