Medium severity · published May 17, 2018
CVE-2018-1466
IBM SAN Volume Controller, IBM Storwize, IBM Spectrum Virtualize and IBM FlashSystem products (6.1, 6.2, 6.3, 6.4, 7.1, 7.2, 7.3, 7.4, 7.5, 7.6, 7.6.1, 7.7, 7.7.1, 7.8, 7.8.1,…
5.3
CVSS
0.8%
EPSS
No
On KEV
Description
IBM SAN Volume Controller, IBM Storwize, IBM Spectrum Virtualize and IBM FlashSystem products (6.1, 6.2, 6.3, 6.4, 7.1, 7.2, 7.3, 7.4, 7.5, 7.6, 7.6.1, 7.7, 7.7.1, 7.8, 7.8.1, 8.1, and 8.1.1) use weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 140397.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
High
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 57% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SV
San Volume Controller Firmware · Ibm
6.1.0.0 before 7.5.0.14; 7.7.0.0 before 7.7.1.9; 7.8.0.0 before 7.8.1.6; 8.1.1.0 before 8.1.1.2; 8.1.2.0 before 8.1.2.1 · source: NVD
SV
Spectrum Virtualize · Ibm
6.1.0.0 before 7.5.0.14; 7.7.0.0 before 7.7.1.9; 7.8.0.0 before 7.8.1.6; 8.1.1.0 before 8.1.1.2; 8.1.2.0 before 8.1.2.1 · source: NVD
SV
Spectrum Virtualize For Public Cloud · Ibm
6.1.0.0 before 7.5.0.14; 7.7.0.0 before 7.7.1.9; 7.8.0.0 before 7.8.1.6; 8.1.1.0 before 8.1.1.2; 8.1.2.0 before 8.1.2.1 · source: NVD
SV
Storwize V3500 Firmware · Ibm
6.1.0.0 before 7.5.0.14; 7.7.0.0 before 7.7.1.9; 7.8.0.0 before 7.8.1.6; 8.1.1.0 before 8.1.1.2; 8.1.2.0 before 8.1.2.1 · source: NVD
SV
Storwize V3700 Firmware · Ibm
6.1.0.0 before 7.5.0.14; 7.7.0.0 before 7.7.1.9; 7.8.0.0 before 7.8.1.6; 8.1.1.0 before 8.1.1.2; 8.1.2.0 before 8.1.2.1 · source: NVD
SV
Storwize V5000 Firmware · Ibm
6.1.0.0 before 7.5.0.14; 7.7.0.0 before 7.7.1.9; 7.8.0.0 before 7.8.1.6; 8.1.1.0 before 8.1.1.2; 8.1.2.0 before 8.1.2.1 · source: NVD
SV
Storwize V7000 Firmware · Ibm
6.1.0.0 before 7.5.0.14; 7.7.0.0 before 7.7.1.9; 7.8.0.0 before 7.8.1.6; 8.1.1.0 before 8.1.1.2; 8.1.2.0 before 8.1.2.1 · source: NVD
SV
Storwize V9000 Firmware · Ibm
6.1.0.0 before 7.5.0.14; 7.7.0.0 before 7.7.1.9; 7.8.0.0 before 7.8.1.6; 8.1.1.0 before 8.1.1.2; 8.1.2.0 before 8.1.2.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-1466
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-1466
Vendor Advisory
http://www.ibm.com/support/docview.wss?uid=ssg1S1012263
Vendor Advisory
http://www.ibm.com/support/docview.wss?uid=ssg1S1012282
Vendor Advisory
http://www.ibm.com/support/docview.wss?uid=ssg1S1012283
Third Party Advisory
http://www.securityfocus.com/bid/104349
VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/140397
More from San Volume Controller Firmware
9.8
CVE-2014-7169
GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability
9.8
CVE-2014-6271
GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability
9.8
CVE-2017-1710
A vulnerability in the Service Assistant GUI in IBM Storwize V7000 (2076) 8.1 could allow a remote attacker to perform a privilege escalation
8.8
CVE-2018-1434
IBM SAN Volume Controller, IBM Storwize, IBM Spectrum Virtualize and IBM FlashSystem products ( 6.1, 6.2, 6.3, 6.4, 7.1, 7.2, 7.3, 7.4, 7.5, 7.6, 7.6.1, 7.7, 7.7.1, 7.8, 7.8.1,…
8.1
CVE-2021-29873
IBM Flash System 900 could allow an authenticated attacker to obtain sensitive information and cause a denial of service due to a restricted shell escape vulnerability