CVE-2021-20740: hitachi and nec corporation hitachi virtual file platform and nec storage m series nas gateway which uses hitachi virtual file platform OS Command Injection

Vulnerability summary

CVE-2021-20740 is a high (CVSS 9.0) OS Command Injection vulnerability in hitachi and nec corporation hitachi virtual file platform and nec storage m series nas gateway which uses hitachi virtual file platform. EPSS estimates a 3.11% chance of exploitation in the next 30 days, higher than 87.6% of scored vulnerabilities.

Timeline

1. 28-06-2021
   PublishedVulnerability first disclosed.
2. 03-08-2024
   Last modifiedVulnerability information updated.

Description

Hitachi Virtual File Platform Versions prior to 5.5.3-09 and Versions prior to 6.4.3-09, and NEC Storage M Series NAS Gateway Nh4a/Nh8a versions prior to FOS 5.5.3-08(NEC2.5.4a) and Nh4b/Nh8b, Nh4c/Nh8c versions prior to FOS 6.4.3-08(NEC3.4.2) allow remote authenticated attackers to execute arbitrary OS commands with root privileges via unspecified vectors.

• CWE-78Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.