Back
CVE-2018-1237
CRITICAL
Dell EMC ScaleIO versions prior to 2.5, contain improper restriction of excessive authentication attempts on the Light installation Agent (LIA). This component is deployed on every server in the ScaleIO cluster and is used for central management of ScaleIO nodes. A remote malicious user, having network access to LIA, could potentially exploit this vulnerability to launch brute force guessing of user names and passwords of user accounts on the LIA.
Published: Mar 27, 2018
Modified: Jun 17, 2026
CWE-287
CVSS Metrics
CVSSv3
Attack Vector:
NETWORK
Attack Complexity:
LOW
Privileges Required:
NONE
User Interaction:
NONE
Scope:
UNCHANGED
Confidentiality Impact:
HIGH
Integrity Impact:
HIGH
Availability Impact:
HIGH
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Products (1)
| Vendor | Product | Version |
|---|---|---|
| dell | emc_scaleio | * < 2.5 |
GitHub Security Advisory GHSA-q97w-4jj3-g574
Dell EMC ScaleIO versions prior to 2.5, contain improper restriction of excessive authentication...
References (2)
- http://seclists.org/fulldisclosure/2018/Mar/59 Mailing List, Third Party Advisory
- http://seclists.org/fulldisclosure/2018/Mar/59 Mailing List, Third Party Advisory
Risk Scores
CVSS Score
9.8 / 10
EPSS Score
1.56%
Top 27% most likely to be exploited
Threat Score
39.7 / 100
Data Sources
NVD
EPSS
GitHub