RCE in Pure Storage Flasharray
CVE-2024-0001
A condition exists in FlashArray Purity whereby a local account intended for initial array configuration remains active potentially allowing a malicious actor to gain elevated privileges.
EPSS: 0.009 (53.8th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 10.0 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H.
Affected products
- Pure Storage Flasharray — versions 6.3.0, 6.4.0
- Purestorage Purity\/\/fa
Weakness classification (CWE)
Public proof-of-concept exploits
- 0xb0rn3/r3cond0g
- ADA-XiaoYao/ADA-XiaoYao-ADA-ZeroDay-Framework-CLI
- GerriaLeSure/cybersecurity-risk-assessment-platform
- Harrywang12/lockdown
- Jimmy-Barrios/EPSS-Scoring
- Mahdi-Assadi/Text_
- ProjectZeroDays/AI-Driven-Zero-Click-Exploit-Deployment-Framework
- ProjectZeroDays/zero-click-exploits
- RobloxSecurityResearcher/RobloxVulnerabilityCVE-2024-0001
- SV-ZeroOne/cyber-ai-info
References
- psirt@purestorage.com (vendor-advisory, Vendor Advisory)
Frequently asked questions
- What is CVE-2024-0001?
- CVE-2024-0001 is a critical-severity vulnerability in Pure Storage Flasharray, classified under Initialization of a Resource with an Insecure Default. CVSS score: 10.0/10. Published 2024-09-23.
- How severe is CVE-2024-0001?
- Critical severity. CVSS v3 base score is 10.0 out of 10.
- Is CVE-2024-0001 known to be exploited?
- 25 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.