Vulnerability · Published Nov 30, 2020 · Assigned by mitre

CVE-2020-29127

Critical 9.8

In plain English

A critical-severity security flaw in the affected software. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 4.5% (higher than 91% of all known vulnerabilities).

Severity (CVSS NVD)9.8Critical

Exploit odds (30 days)4.5%top 8.5% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

An issue was discovered on Fujitsu Eternus Storage DX200 S4 devices through 2020-11-25. After logging into the portal as a root user (using any web browser), the portal can be accessed with root privileges when the URI cgi-bin/csp?cspid={XXXXXXXXXX}&csppage=cgi_PgOverview&csplang=en is visited from a different web browser.

Affected products (as reported)

Vendor	Product	Versions
n/a	n/a	n/a

References

https://www.first.org/members/teams/fujitsu_psirt x_refsource_MISC
http://packetstormsecurity.com/files/160255/Fujitsu-Eternus-Storage-DX200-S4-Broken-Authentication.html x_refsource_MISC
https://cxsecurity.com/issue/WLB-2020110215 x_refsource_MISC
https://seccops.com/fujitsu-eternus-storage-dx200-s4-broken-authentication/ x_refsource_MISC