CVE-2020-5684

iSM client versions from V5.1 prior to V12.1 running on NEC Storage Manager or NEC Storage Manager Express does not verify a server certificate properly, which allows a man-in-the-middle attacker to eavesdrop on an encrypted communication or alter the communication via a crafted certificate.

Score

CVSS 3.1 4.8 Medium

Status

Modified - vultures@jpcert.or.jp

Published

2020-12-24

Last modified

2024-08-04

Weaknesses

CWE-295

Affected products

• Ism Server (Nec)
• Management Software For Nec Storage Disk Array System (Nec Corporation)

References

• https://jpn.nec.com/security-info/secinfo/nv20-015.html
• https://jvn.jp/en/jp/JVN10100024/index.html