CVE-2021-29873: IBM Flashsystem 9000 Firmware

High severity, CVSS 8.1. EPSS: 1.5% chance of exploitation in the next 30 days.

IBM Flash System 900 could allow an authenticated attacker to obtain sensitive information and cause a denial of service due to a restricted shell escape vulnerability. IBM X-Force ID: 206229.

Affected products

• IBM Flashsystem 9000 Firmware: from 7.8.0.0, before 8.4.0.0 (fixed in 8.4.0.0)
• IBM Flashsystem 9100 Firmware: from 7.8.0.0, before 8.4.0.0 (fixed in 8.4.0.0)
• IBM San Volume Controller Firmware: from 7.8.0.0, before 8.4.0.0 (fixed in 8.4.0.0)
• IBM Spectrum Virtualize: from 7.8.0.0, before 8.4.0.0 (fixed in 8.4.0.0)
• IBM Spectrum Virtualize For Public Cloud: from 7.8.0.0, before 8.4.0.0 (fixed in 8.4.0.0)
• IBM Storwize v3500 Software: from 7.8.0.0, before 8.4.0.0 (fixed in 8.4.0.0)
• IBM Storwize v3700 Software: from 7.8.0.0, before 8.4.0.0 (fixed in 8.4.0.0)
• IBM Storwize v5000 Software: from 7.8.0.0, before 8.4.0.0 (fixed in 8.4.0.0)
• IBM Storwize v5100 Software: from 7.8.0.0, before 8.4.0.0 (fixed in 8.4.0.0)
• IBM Storwize v7000 Software: from 7.8.0.0, before 8.4.0.0 (fixed in 8.4.0.0)

Published 2021-10-21. Last modified 2026-06-17.