CVE-2018-1822

IBM FlashSystem 900 product GUI allows a specially crafted attack to bypass the authentication requirements of the system, resulting in the ability to remotely change the superuser password. This can be used by an attacker to gain administrative control or to deny service. IBM X-Force ID: 150296.

Score

CVSS 3.0 9.8 Critical

Status

Modified - psirt@us.ibm.com

Published

2018-10-18

Last modified

2025-02-13

Weaknesses

CWE-287

Affected products

• Flashsystem 840 Firmware (Ibm)
• Flashsystem 900 (Ibm)
• Flashsystem 900 Firmware (Ibm)

References

• http://www.ibm.com/support/docview.wss?uid=ibm10732962
• https://exchange.xforce.ibmcloud.com/vulnerabilities/150296