CVE-2021-38969

Vulnerability

IBM Spectrum Virtualize versions 8.2, 8.3, and 8.4 contain a vulnerability in the challenge/response authentication mechanism used by IBM remote support [1]. The flaw allows support-generated credentials to be reused on the product's management GUI, bypassing normal authentication controls. Earlier code levels (e.g., 7.8.1) and later code levels (e.g., 8.5.0) are not affected [1].

Exploitation

An attacker with network access to the management GUI can exploit this vulnerability by reusing previously generated support credentials [1]. The attack requires no authentication and has high complexity (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L) [1]. The attacker must obtain valid support credentials, possibly through prior compromise or interception, and then present them to the GUI to gain unauthorized access.

Impact

Successful exploitation allows an attacker to gain unauthorized access to the management GUI, resulting in low confidentiality, integrity, and availability impacts [1]. The attacker may view or modify system configuration or cause limited disruption, but the scope remains unchanged (S:U) [1].

Mitigation

IBM has released fixed versions: upgrade to 8.5.0.0, 8.4.0.6, 8.3.1.7, or 8.2.1.15 [1]. No workaround is available. The vulnerability is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog as of the publication date.