CVE-2020-29502

Vulnerability

Dell EMC PowerStore versions prior to 1.0.3.0.5.007 contain a Plain-Text Password Storage Vulnerability in PowerStore X and T environments [1]. User credentials are stored in plain text, making them accessible to an attacker with local system access.

Exploitation

To exploit this vulnerability, an attacker must already be authenticated to the PowerStore system locally. The attack complexity is high, but once authenticated, the attacker can read the stored credentials from the system files or memory, revealing the passwords of other users [1].

Impact

Successful exploitation results in the disclosure of certain user credentials. The attacker can then use these credentials to access the vulnerable application with the privileges of the compromised account, potentially leading to privilege escalation and compromise of confidentiality, integrity, and availability [1].

Mitigation

Dell released a fixed version, 1.0.3.0.5.007, to address this vulnerability. Users should upgrade to this version or later. No workaround is available. The CVE is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog as of the publication date [1].