Read the docs
TI-2018-01127 Aliases CVE-2018-1216GHSA-xp9f-vm29-4q5v

Hard-coded credentials in vApp Manager which is embedded in Dell EMC Unisphere for VMAX…

Priority MEDIUM 61CWE-798Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-798.

Summary

A hard-coded password vulnerability was discovered in vApp Manager which is embedded in Dell EMC Unisphere for VMAX, Dell EMC Solutions Enabler, Dell EMC VASA Virtual Appliances, and Dell EMC VMAX Embedded Management (eManagement): Dell EMC Unisphere for VMAX Virtual Appliance versions prior to 8.4.0.18, Dell EMC Solutions Enabler Virtual Appliance versions prior to 8.4.0.21, Dell EMC VASA Virtual Appliance versions prior to 8.4.0.514, and Dell EMC VMAX Embedded Management (eManagement) versions prior to and including 1.4 (Enginuity Release 5977.1125.1125 and earlier). They contain an undocumented default account (smc) with a hard-coded password that may be used with certain web servlets. A remote attacker with the knowledge of the hard-coded password and the message format may use vulnerable servlets to gain unauthorized access to the system. Note: This account cannot be used to log in via the web user interface.

Why it matters now

EPSS 0.21313 97th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—vApp Manager which is embedded in Dell EMC Unisphere for VMAX, Dell EMC Solutions Enabler, Dell EMC VASA Virtual Appliances, and Dell EMC VMAX Embedded Management (eManagement)vApp Manager which is embedded in Dell EMC Unisphere for VMAX, Dell EMC Solutions Enabler, Dell EMC VASA Virtual Appliances, and Dell EMC VMAX Embedded Management (eManagement)—No fix listedCNA
  • vApp Manager which is embedded in Dell EMC Unisphere for VMAX, Dell EMC Solutions Enabler, Dell EMC VASA Virtual Appliances, and Dell EMC VMAX Embedded Management (eManagement) Vendor— Affected vApp Manager which is embedded in Dell EMC Unisphere for VMAX, Dell EMC Solutions Enabler, Dell EMC VASA Virtual Appliances, and Dell EMC VMAX Embedded Management (eManagement) Fixed in — No fix listed CNA

CPE configurations NVD · 4

CPEVersionsRoleVendor
cpe:2.3:a:dell:emc_solutions_enabler_virtual_appliance:*:*:*:*:*:*:*:*before 8.4.0.21VulnerableDell
cpe:2.3:a:dell:emc_unisphere_for_vmax_virtual_appliance:*:*:*:*:*:*:*:*before 8.4.0.18VulnerableDell
cpe:2.3:a:dell:emc_vasa_virtual_appliance:*:*:*:*:*:*:*:*before 8.4.0.514VulnerableDell
cpe:2.3:a:dell:emc_vmax_embedded_management:*:*:*:*:*:*:*:*up to 1.4VulnerableDell
  • cpe:2.3:a:dell:emc_solutions_enabler_virtual_appliance:*:*:*:*:*:*:*:* Versions before 8.4.0.21 Vulnerable ·Dell
  • cpe:2.3:a:dell:emc_unisphere_for_vmax_virtual_appliance:*:*:*:*:*:*:*:* Versions before 8.4.0.18 Vulnerable ·Dell
  • cpe:2.3:a:dell:emc_vasa_virtual_appliance:*:*:*:*:*:*:*:* Versions before 8.4.0.514 Vulnerable ·Dell
  • cpe:2.3:a:dell:emc_vmax_embedded_management:*:*:*:*:*:*:*:* Versions up to 1.4 Vulnerable ·Dell

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2018-1216
  2. 2026-10-03 Alias added: GHSA-xp9f-vm29-4q5v

References

Advisory 2

  • TI-2018-01098 XML external entity injection in Dell EMC Unisphere for VMAX Virtual Appliance, Dell EMC… CVSS 3.0CRITICAL 9.8
  • TI-2018-01126 Unrestricted file upload in vApp Manager which is embedded in Dell EMC Unisphere for… CVSS 3.0HIGH 8.8
  • TI-2022-22192 Information disclosure in Dell Unisphere for PowerMax vApp CVSS 3.1MEDIUM 6.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences