CVE-2022-29084

Vulnerability

The Unisphere GUI component of Dell Unity, UnityVSA, and Unity XT operating environments prior to version 5.2.0.0.5.173 does not impose rate limits on authentication attempts. This allows an attacker to submit an unlimited number of login requests without restriction, making brute-force attacks feasible. Affected versions include all releases before 5.2.0.0.5.173 for all three product lines [1].

Exploitation

An unauthenticated, remote attacker can send repeated login requests to the Unisphere GUI over the network. No prior access or user interaction is required. The attacker systematically attempts passwords against known usernames or enumerates until successful authentication is achieved.

Impact

Successful brute-force leads to account takeover, allowing the attacker to gain the same privileges as the victim user. If weak passwords are used, the attack becomes particularly effective. The compromised account can then be used to access and potentially manipulate storage system configurations and data.

Mitigation

Dell has released version 5.2.0.0.5.173 of the Unity Operating Environment (and associated products) to address this issue. Users are advised to apply the update from Dell's support site. As a workaround, implement network-level access controls to limit exposure of the Unisphere GUI to trusted networks and enforce strong password policies [1].