Netapp Altavault vulnerabilities

3 CVEs affecting Netapp Altavault, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2019-14815, published 2019-11-25.

More from Netapp.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2019-1559, published 2019-02-27. Medium severity, CVSS 5.9. EPSS: 17.1% chance of exploitation in the next 30 days. If an application encounters a fatal protocol error and then calls SSL_shutdown() twice (once to send a close_notify, and once to receive one) then OpenSSL can respond differently to the calling…
• CVE-2016-3998, published 2017-07-03. High severity, CVSS 8.1. EPSS: 0.9% chance of exploitation in the next 30 days. NetApp AltaVault 4.1 and earlier allows man-in-the-middle attackers to obtain sensitive information, gain privileges, or cause a denial of service via vectors related to the SMB protocol.
• CVE-2019-14815, published 2019-11-25. High severity, CVSS 7.8. EPSS: 0.5% chance of exploitation in the next 30 days. A vulnerability was found in Linux Kernel, where a Heap Overflow was found in mwifiex_set_wmm_params() function of Marvell Wifi Driver.