Vulnerability identifier: #VU94707

Vulnerability risk: Medium

CVSSv3.1: 5.7 [CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-25031

CWE-ID: CWE-307

Exploitation vector: Local network

Exploit availability: No

Vulnerable software:
Storage Defender - Resiliency Service
Other software / Other software solutions

Vendor: IBM Corporation

Description

The vulnerability allows a remote attacker in adjacent network to gain access to potentially sensitive information.

The vulnerability exists due to usage of an inadequate account lockout setting. A remote attacker in adjacent network can brute force account credentials to gain unauthorized access to sensitive information on the system.

Mitigation
Install updates from vendor's website.

Vulnerable software versions

Storage Defender - Resiliency Service : 2.0.0 - 2.0.4

---

External links
http://www.ibm.com/support/pages/node/7158446
http://exchange.xforce.ibmcloud.com/vulnerabilities/281678

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.