// For flags

CVE-2023-6538

System Management Unit (SMU) versions prior to 14.8.7825.01, used to manage Hitachi Vantara NAS products is susceptible to unintended information disclosure via unprivileged access to SMU configuration backup data.

Severity Score

6.5
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

2
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

SMU versions prior to 14.8.7825.01 are susceptible to unintended information disclosure, through URL manipulation. Authenticated users in Storage, Server or combined Server+Storage administrative roles are able to access SMU configuration backup, that would normally be barred to those specific administrative roles.

Las versiones de SMU anteriores a 14.8.7825.01 son susceptibles a la divulgación de información no intencionada mediante la manipulación de URL. Los usuarios autenticados en funciones administrativas de Almacenamiento, Servidor o combinadas de Servidor+Almacenamiento pueden acceder a la copia de seguridad de la configuración de SMU, que normalmente estaría prohibida para esas funciones administrativas específicas.

Hitachi NAS (HNAS) System Management Unit (SMU) version 14.8.7825 suffers from an information disclosure vulnerability.

*Credits: Arslan Masood
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
Low
Availability
Low
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2023-12-05 CVE Reserved
  • 2023-12-11 CVE Published
  • 2023-12-18 First Exploit
  • 2024-08-02 CVE Updated
  • 2024-10-06 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
CWE
  • CWE-285: Improper Authorization
CAPEC
  • CAPEC-37: Retrieve Embedded Sensitive Data
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Hitachi
Search vendor "Hitachi"
 System Management Unit Firmware
Search vendor "Hitachi" for product "System Management Unit Firmware"
 < 14.8.7825.01
Search vendor "Hitachi" for product "System Management Unit Firmware" and version " < 14.8.7825.01"
-
Affected
in Hitachi
Search vendor "Hitachi"
 System Management Unit
Search vendor "Hitachi" for product "System Management Unit"
--
Safe