title: QSAN Storage Manager, XEVO, SANOS - Use of Hard-coded Password
description: Use of MAC address as an authenticated password in QSAN Storage Manager, XEVO, SANOS allows local attackers to escalate privileges. Suggest contacting with QSAN and refer to recommendations in QSAN Document.
problem types: CWE-259 Use of Hard-coded Password
affected:
{
product: Storage Manager
vendor: QSAN
versions:
lessThanOrEqual: 3.3.1, status: affected, version: unspecified, versionType: custom
}
{
product: XEVO
vendor: QSAN
versions:
lessThan: 1.2.0, status: affected, version: unspecified, versionType: custom
}
{
product: SANOS
vendor: QSAN
versions:
lessThanOrEqual: 2.0.0, status: affected, version: unspecified, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 7.3
baseSeverity: HIGH
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
version: 3.1
]
solutions: Please refer to QSANS's recommended measures