IBM Flashsystem 900 Firmware vulnerabilities

3 CVEs affecting IBM Flashsystem 900 Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2020-4987, published 2021-05-04.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2018-1822, published 2018-10-18. Critical severity, CVSS 9.8. EPSS: 3.4% chance of exploitation in the next 30 days. IBM FlashSystem 900 product GUI allows a specially crafted attack to bypass the authentication requirements of the system, resulting in the ability to remotely change the superuser password. This can…
CVE-2018-1495, published 2018-05-29. Medium severity, CVSS 6.5. EPSS: 1.6% chance of exploitation in the next 30 days. IBM FlashSystem V840 and V900 products could allow an authenticated attacker with specialized access to overwrite arbitrary files which could cause a denial of service. IBM X-Force ID: 141148.
CVE-2020-4987, published 2021-05-04. Medium severity, CVSS 5.4. EPSS: 0.5% chance of exploitation in the next 30 days. The IBM FlashSystem 900 user management GUI is vulnerable to stored cross-site scripting in code versions 1.5.2.8 and prior and 1.6.1.2 and prior. This vulnerability allows users to embed arbitrary…