CERTFR-2026-AVI-0287

Vulnerability from certfr_avis - Published: 2026-03-13 - Updated: 2026-03-13

De multiples vulnérabilités ont été découvertes dans les produits NetApp. Elles permettent à un attaquant de provoquer un déni de service à distance, une atteinte à la confidentialité des données et une atteinte à l'intégrité des données.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products
Vendor Product Description
NetApp FAS/AFF Baseboard Management Controller (BMC) - A800/C800 FAS/AFF Baseboard Management Controller (BMC) - A800/C800 versions antérieures à 10.10
NetApp SolidFire & HCI Storage Node (Element Software) NetApp SolidFire & HCI Storage Node (Element Software) versions antérieures à 12.8
NetApp NetApp HCI Baseboard Management Controller (BMC) - H410C NetApp HCI Baseboard Management Controller (BMC) - H410C
NetApp N/A Management Services for Element Software and NetApp HCI versions antérieures à 2.25.42
NetApp ONTAP Select Deploy administration utility ONTAP Select Deploy administration utility versions antérieures à 9.14.1
NetApp E-Series SANtricity OS Controller Software 11.x E-Series SANtricity OS Controller Software 11.x versions antérieures à 11.70.2
NetApp N/A AFF/ASA/FAS Baseboard Management Controller (BMC) - A50/A30/A20/C60/C30/FAS50 versions antérieures à 19.1
NetApp FAS/AFF Baseboard Management Controller (BMC) - C190/A150/A220/FAS2720/FAS2750 FAS/AFF Baseboard Management Controller (BMC) - C190/A150/A220/FAS2720/FAS2750 versions antérieures à 11.11
NetApp N/A Astra Control Center versions antérieures à 23.10.0
NetApp NetApp HCI Baseboard Management Controller (BMC) - H610S NetApp HCI Baseboard Management Controller (BMC) - H610S
NetApp N/A NetApp Cloud Backup (formerly AltaVault)
NetApp N/A Trident versions antérieures à 23.10.0
NetApp NetApp HCI Baseboard Management Controller (BMC) - H610C NetApp HCI Baseboard Management Controller (BMC) - H410C
NetApp N/A Trident Autosupport versions antérieures à 23.10.0
NetApp Brocade Fabric Operating System Firmware Brocade Fabric Operating System Firmware versions antérieures à 9.2.0
NetApp FAS/AFF Baseboard Management Controller (BMC) - A900/9500 FAS/AFF Baseboard Management Controller (BMC) - A900/9500 versions antérieures à 16.6
NetApp N/A FAS/AFF Baseboard Management Controller (BMC) - 8300/8700/A400/C400 versions antérieures à 13.10P1
NetApp Active IQ Unified Manager pour VMware vSphere Active IQ Unified Manager for VMware vSphere versions antérieures à 9.16P2
NetApp N/A AFF/ASA/FAS Baseboard Management Controller (BMC) - A1K/A90/A70/C80/FAS90/FAS70 versions antérieures à 18.2
NetApp NetApp HCI Baseboard Management Controller (BMC) - H610C NetApp HCI Baseboard Management Controller (BMC) - H610C
NetApp NetApp SolidFire & HCI Management Node NetApp SolidFire & HCI Management Node versions antérieures à 2.25.42
NetApp NetApp SolidFire & HCI Management Node NetApp SolidFire & HCI Management Node versions antérieures à 12.8
NetApp N/A NetApp SolidFire Baseboard Management Controller (BMC)
NetApp NetApp HCI Baseboard Management Controller (BMC) - H300S/H500S/H700S/H410S NetApp HCI Baseboard Management Controller (BMC) - H300S/H500S/H700S/H410S
NetApp FAS/AFF Baseboard Management Controller (BMC) - FAS2820 FAS/AFF Baseboard Management Controller (BMC) - FAS2820 versions antérieures à 17.3
NetApp N/A OnCommand Insight versions antérieures à 7.3.15
NetApp HCI Compute Node (Bootstrap OS) NetApp HCI Compute Node (Bootstrap OS)
References

Show details on source website
To clipboard 

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "FAS/AFF Baseboard Management Controller (BMC) - A800/C800 versions ant\u00e9rieures \u00e0 10.10",
      "product": {
        "name": "FAS/AFF Baseboard Management Controller (BMC) - A800/C800",
        "vendor": {
          "name": "NetApp",
          "scada": false
        }
      }
    },
    {
      "description": "NetApp SolidFire \u0026 HCI Storage Node (Element Software) versions ant\u00e9rieures \u00e0 12.8",
      "product": {
        "name": "SolidFire \u0026 HCI Storage Node (Element Software)",
        "vendor": {
          "name": "NetApp",
          "scada": false
        }
      }
    },
    {
      "description": "NetApp HCI Baseboard Management Controller (BMC) - H410C",
      "product": {
        "name": "NetApp HCI Baseboard Management Controller (BMC) - H410C",
        "vendor": {
          "name": "NetApp",
          "scada": false
        }
      }
    },
    {
      "description": "Management Services for Element Software and NetApp HCI versions ant\u00e9rieures \u00e0 2.25.42",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "NetApp",
          "scada": false
        }
      }
    },
    {
      "description": "ONTAP Select Deploy administration utility versions ant\u00e9rieures \u00e0 9.14.1",
      "product": {
        "name": "ONTAP Select Deploy administration utility",
        "vendor": {
          "name": "NetApp",
          "scada": false
        }
      }
    },
    {
      "description": "E-Series SANtricity OS Controller Software 11.x versions ant\u00e9rieures \u00e0 11.70.2",
      "product": {
        "name": "E-Series SANtricity OS Controller Software 11.x",
        "vendor": {
          "name": "NetApp",
          "scada": false
        }
      }
    },
    {
      "description": "AFF/ASA/FAS Baseboard Management Controller (BMC) - A50/A30/A20/C60/C30/FAS50 versions ant\u00e9rieures \u00e0 19.1",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "NetApp",
          "scada": false
        }
      }
    },
    {
      "description": "FAS/AFF Baseboard Management Controller (BMC) - C190/A150/A220/FAS2720/FAS2750 versions ant\u00e9rieures \u00e0 11.11",
      "product": {
        "name": "FAS/AFF Baseboard Management Controller (BMC) - C190/A150/A220/FAS2720/FAS2750",
        "vendor": {
          "name": "NetApp",
          "scada": false
        }
      }
    },
    {
      "description": "Astra Control Center versions ant\u00e9rieures \u00e0 23.10.0",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "NetApp",
          "scada": false
        }
      }
    },
    {
      "description": "NetApp HCI Baseboard Management Controller (BMC) - H610S",
      "product": {
        "name": "NetApp HCI Baseboard Management Controller (BMC) - H610S",
        "vendor": {
          "name": "NetApp",
          "scada": false
        }
      }
    },
    {
      "description": "NetApp Cloud Backup (formerly AltaVault)",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "NetApp",
          "scada": false
        }
      }
    },
    {
      "description": "Trident versions ant\u00e9rieures \u00e0 23.10.0",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "NetApp",
          "scada": false
        }
      }
    },
    {
      "description": "NetApp HCI Baseboard Management Controller (BMC) - H410C",
      "product": {
        "name": "NetApp HCI Baseboard Management Controller (BMC) - H610C",
        "vendor": {
          "name": "NetApp",
          "scada": false
        }
      }
    },
    {
      "description": "Trident Autosupport versions ant\u00e9rieures \u00e0 23.10.0",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "NetApp",
          "scada": false
        }
      }
    },
    {
      "description": "Brocade Fabric Operating System Firmware versions ant\u00e9rieures \u00e0 9.2.0",
      "product": {
        "name": "Brocade Fabric Operating System Firmware",
        "vendor": {
          "name": "NetApp",
          "scada": false
        }
      }
    },
    {
      "description": "FAS/AFF Baseboard Management Controller (BMC) - A900/9500 versions ant\u00e9rieures \u00e0 16.6",
      "product": {
        "name": "FAS/AFF Baseboard Management Controller (BMC) - A900/9500",
        "vendor": {
          "name": "NetApp",
          "scada": false
        }
      }
    },
    {
      "description": "FAS/AFF Baseboard Management Controller (BMC) - 8300/8700/A400/C400 versions ant\u00e9rieures \u00e0 13.10P1",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "NetApp",
          "scada": false
        }
      }
    },
    {
      "description": "Active IQ Unified Manager for VMware vSphere  versions ant\u00e9rieures \u00e0 9.16P2",
      "product": {
        "name": "Active IQ Unified Manager pour VMware vSphere",
        "vendor": {
          "name": "NetApp",
          "scada": false
        }
      }
    },
    {
      "description": "AFF/ASA/FAS Baseboard Management Controller (BMC) - A1K/A90/A70/C80/FAS90/FAS70 versions ant\u00e9rieures \u00e0 18.2",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "NetApp",
          "scada": false
        }
      }
    },
    {
      "description": "NetApp HCI Baseboard Management Controller (BMC) - H610C",
      "product": {
        "name": "NetApp HCI Baseboard Management Controller (BMC) - H610C",
        "vendor": {
          "name": "NetApp",
          "scada": false
        }
      }
    },
    {
      "description": "NetApp SolidFire \u0026 HCI Management Node versions ant\u00e9rieures \u00e0 2.25.42",
      "product": {
        "name": "NetApp SolidFire \u0026 HCI Management Node",
        "vendor": {
          "name": "NetApp",
          "scada": false
        }
      }
    },
    {
      "description": "NetApp SolidFire \u0026 HCI Management Node versions ant\u00e9rieures \u00e0 12.8",
      "product": {
        "name": "NetApp SolidFire \u0026 HCI Management Node",
        "vendor": {
          "name": "NetApp",
          "scada": false
        }
      }
    },
    {
      "description": "NetApp SolidFire Baseboard Management Controller (BMC)",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "NetApp",
          "scada": false
        }
      }
    },
    {
      "description": "NetApp HCI Baseboard Management Controller (BMC) - H300S/H500S/H700S/H410S",
      "product": {
        "name": "NetApp HCI Baseboard Management Controller (BMC) - H300S/H500S/H700S/H410S",
        "vendor": {
          "name": "NetApp",
          "scada": false
        }
      }
    },
    {
      "description": "FAS/AFF Baseboard Management Controller (BMC) - FAS2820 versions ant\u00e9rieures \u00e0 17.3",
      "product": {
        "name": "FAS/AFF Baseboard Management Controller (BMC) - FAS2820",
        "vendor": {
          "name": "NetApp",
          "scada": false
        }
      }
    },
    {
      "description": "OnCommand Insight versions ant\u00e9rieures \u00e0 7.3.15",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "NetApp",
          "scada": false
        }
      }
    },
    {
      "description": "NetApp HCI Compute Node (Bootstrap OS)",
      "product": {
        "name": "HCI Compute Node (Bootstrap OS)",
        "vendor": {
          "name": "NetApp",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2022-30594",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-30594"
    },
    {
      "name": "CVE-2023-44487",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-44487"
    },
    {
      "name": "CVE-2022-28893",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-28893"
    },
    {
      "name": "CVE-2023-3341",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-3341"
    },
    {
      "name": "CVE-2022-2309",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-2309"
    },
    {
      "name": "CVE-2021-33909",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-33909"
    },
    {
      "name": "CVE-2022-0492",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-0492"
    },
    {
      "name": "CVE-2022-23218",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-23218"
    },
    {
      "name": "CVE-2024-26633",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-26633"
    },
    {
      "name": "CVE-2021-35942",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-35942"
    },
    {
      "name": "CVE-2024-26641",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-26641"
    },
    {
      "name": "CVE-2022-23219",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-23219"
    }
  ],
  "initial_release_date": "2026-03-13T00:00:00",
  "last_revision_date": "2026-03-13T00:00:00",
  "links": [],
  "reference": "CERTFR-2026-AVI-0287",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2026-03-13T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits NetApp. Elles permettent \u00e0 un attaquant de provoquer un d\u00e9ni de service \u00e0 distance, une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es et une atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es.",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits NetApp",
  "vendor_advisories": [
    {
      "published_at": "2026-03-11",
      "title": "Bulletin de s\u00e9curit\u00e9 NetApp NTAP-20210827-0005",
      "url": "https://security.netapp.com/advisory/NTAP-20210827-0005"
    },
    {
      "published_at": "2026-03-11",
      "title": "Bulletin de s\u00e9curit\u00e9 NetApp NTAP-20220915-0006",
      "url": "https://security.netapp.com/advisory/NTAP-20220915-0006"
    },
    {
      "published_at": "2026-03-11",
      "title": "Bulletin de s\u00e9curit\u00e9 NetApp NTAP-20231016-0001",
      "url": "https://security.netapp.com/advisory/NTAP-20231016-0001"
    },
    {
      "published_at": "2026-03-11",
      "title": "Bulletin de s\u00e9curit\u00e9 NetApp NTAP-20220131-0003",
      "url": "https://security.netapp.com/advisory/NTAP-20220131-0003"
    },
    {
      "published_at": "2026-03-11",
      "title": "Bulletin de s\u00e9curit\u00e9 NetApp NTAP-20210819-0004",
      "url": "https://security.netapp.com/advisory/NTAP-20210819-0004"
    },
    {
      "published_at": "2026-03-11",
      "title": "Bulletin de s\u00e9curit\u00e9 NetApp NTAP-20241220-0001",
      "url": "https://security.netapp.com/advisory/NTAP-20241220-0001"
    },
    {
      "published_at": "2026-03-12",
      "title": "Bulletin de s\u00e9curit\u00e9 NetApp NTAP-20231013-0003",
      "url": "https://security.netapp.com/advisory/NTAP-20231013-0003"
    },
    {
      "published_at": "2026-03-11",
      "title": "Bulletin de s\u00e9curit\u00e9 NetApp NTAP-20220419-0002",
      "url": "https://security.netapp.com/advisory/NTAP-20220419-0002"
    },
    {
      "published_at": "2026-03-11",
      "title": "Bulletin de s\u00e9curit\u00e9 NetApp NTAP-20220526-0002",
      "url": "https://security.netapp.com/advisory/NTAP-20220526-0002"
    },
    {
      "published_at": "2026-03-11",
      "title": "Bulletin de s\u00e9curit\u00e9 NetApp NTAP-20241108-0008",
      "url": "https://security.netapp.com/advisory/NTAP-20241108-0008"
    },
    {
      "published_at": "2026-03-11",
      "title": "Bulletin de s\u00e9curit\u00e9 NetApp NTAP-20220707-0001",
      "url": "https://security.netapp.com/advisory/NTAP-20220707-0001"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.