iSCSI-accessible Storage Devices Multiple Vulnerabilities

Last Update Date: 4 Apr 2019 Release Date: 3 Apr 2019 4228 Views

RISK: Medium Risk

TYPE: Servers - Network Management

Multiple vulnerabilities have been identified in iSCSI-accessible storage devices, a remote attacker can exploit these vulnerabilities to trigger remote code execution, sensitive information disclosure and tampering on the targeted system.

Impact

Remote Code Execution
Information Disclosure
Data Manipulation

System / Technologies affected

iSCSI storage devices without password protection setting

Solutions

To protect your iSCSI-accessible storage device from being compromised by attackers:

Please check if your storage can be exposed to the Internet.
Please check and confirm if the storage is password protected.
Please keep the log of these storage for potential criminal investigation.
Please consider additional protection measures, e.g. protect it by firewall, and restrict the access to certain IP addresses only

Vulnerability Identifier

No CVE information is available

Source

ZDNet