CVE-2020-29489

Vulnerability

Dell EMC Unity, Unity XT, and UnityVSA versions prior to 5.0.4.0.5.012 contain a plain-text password storage vulnerability. User credentials, including the Unisphere admin privilege user password, are stored in plain text in a system file. This affects all configurations where the system file is accessible to local users [1].

Exploitation

An attacker must have local authenticated access to the affected system and the ability to read the system file where the password is stored. No additional privileges or user interaction are required beyond standard file read permissions. The attacker can then extract the plain-text password from the file [1].

Impact

Successful exploitation allows the attacker to obtain the credentials of the compromised user, including the Unisphere admin user. This can lead to unauthorized access with the same privileges as that user, potentially resulting in full administrative control over the storage system [1].

Mitigation

Dell EMC released a fix in version 5.0.4.0.5.012 and later. Users should upgrade to this version or a subsequent release. No workarounds are documented; the only mitigation is to apply the update [1].