Certain versions between 2.x to 5.x (refer to advisory) of the NetApp Service Processor…
Priority MEDIUM 48CWE-1188Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA.
Summary
Certain versions between 2.x to 5.x (refer to advisory) of the NetApp Service Processor firmware were shipped with a default account enabled that could allow unauthorized arbitrary command execution. Any platform listed in the advisory Impact section may be affected and should be upgraded to a fixed version of Service Processor firmware IMMEDIATELY.
Why it matters now
EPSS 0.03493 89th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| NetApp | NetApp Service Processor | 2.x-5.x - refer to advisory | — | No fix listed | CNA |
- NetApp Service Processor VendorNetApp Affected 2.x-5.x - refer to advisory Fixed in — No fix listed CNA
CPE configurations NVD · 50
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:netapp:service_processor:2.8:-:*:*:*:*:*:* | 2.8 | Vulnerable | NetApp |
| cpe:2.3:a:netapp:service_processor:3.7:-:*:*:*:*:*:* | 3.7 | Vulnerable | NetApp |
| cpe:2.3:a:netapp:service_processor:4.5:-:*:*:*:*:*:* | 4.5 | Vulnerable | NetApp |
| cpe:2.3:a:netapp:service_processor:5.5:-:*:*:*:*:*:* | 5.5 | Vulnerable | NetApp |
| cpe:2.3:o:netapp:clustered_data_ontap:9.5:*:*:*:*:*:*:* | 9.5 | Running on | NetApp |
| cpe:2.3:o:netapp:clustered_data_ontap:9.4:*:*:*:*:*:*:* | 9.4 | Running on | NetApp |
| cpe:2.3:o:netapp:clustered_data_ontap:9.3:*:*:*:*:*:*:* | 9.3 | Running on | NetApp |
| cpe:2.3:a:netapp:service_processor:2.5:-:*:*:*:*:*:* | 2.5 | Vulnerable | NetApp |
| cpe:2.3:a:netapp:service_processor:3.4:-:*:*:*:*:*:* | 3.4 | Vulnerable | NetApp |
| cpe:2.3:a:netapp:service_processor:3.4:patch1:*:*:*:*:*:* | 3.4 patch1 | Vulnerable | NetApp |
- cpe:2.3:a:netapp:service_processor:2.8:-:*:*:*:*:*:* Versions 2.8 Vulnerable ·NetApp
- cpe:2.3:a:netapp:service_processor:3.7:-:*:*:*:*:*:* Versions 3.7 Vulnerable ·NetApp
- cpe:2.3:a:netapp:service_processor:4.5:-:*:*:*:*:*:* Versions 4.5 Vulnerable ·NetApp
- cpe:2.3:a:netapp:service_processor:5.5:-:*:*:*:*:*:* Versions 5.5 Vulnerable ·NetApp
- cpe:2.3:o:netapp:clustered_data_ontap:9.5:*:*:*:*:*:*:* Versions 9.5 Running on ·NetApp
- cpe:2.3:o:netapp:clustered_data_ontap:9.4:*:*:*:*:*:*:* Versions 9.4 Running on ·NetApp
- cpe:2.3:o:netapp:clustered_data_ontap:9.3:*:*:*:*:*:*:* Versions 9.3 Running on ·NetApp
- cpe:2.3:a:netapp:service_processor:2.5:-:*:*:*:*:*:* Versions 2.5 Vulnerable ·NetApp
- cpe:2.3:a:netapp:service_processor:3.4:-:*:*:*:*:*:* Versions 3.4 Vulnerable ·NetApp
- cpe:2.3:a:netapp:service_processor:3.4:patch1:*:*:*:*:*:* Versions 3.4 patch1 Vulnerable ·NetApp
Show 40 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:netapp:service_processor:3.4:patch2:*:*:*:*:*:* | 3.4 patch2 | Vulnerable | NetApp |
| cpe:2.3:a:netapp:service_processor:4.2:-:*:*:*:*:*:* | 4.2 | Vulnerable | NetApp |
| cpe:2.3:a:netapp:service_processor:4.2:patch1:*:*:*:*:*:* | 4.2 patch1 | Vulnerable | NetApp |
| cpe:2.3:a:netapp:service_processor:4.2:patch2:*:*:*:*:*:* | 4.2 patch2 | Vulnerable | NetApp |
| cpe:2.3:a:netapp:service_processor:5.2:-:*:*:*:*:*:* | 5.2 | Vulnerable | NetApp |
| cpe:2.3:a:netapp:service_processor:5.2:patch1:*:*:*:*:*:* | 5.2 patch1 | Vulnerable | NetApp |
| cpe:2.3:o:netapp:clustered_data_ontap:9.2:*:*:*:*:*:*:* | 9.2 | Running on | NetApp |
| cpe:2.3:a:netapp:service_processor:2.4.1:-:*:*:*:*:*:* | 2.4.1 | Vulnerable | NetApp |
| cpe:2.3:a:netapp:service_processor:2.4.1:patch1:*:*:*:*:*:* | 2.4.1 patch1 | Vulnerable | NetApp |
| cpe:2.3:a:netapp:service_processor:3.3:-:*:*:*:*:*:* | 3.3 | Vulnerable | NetApp |
| cpe:2.3:a:netapp:service_processor:3.3:patch1:*:*:*:*:*:* | 3.3 patch1 | Vulnerable | NetApp |
| cpe:2.3:a:netapp:service_processor:3.3:patch2:*:*:*:*:*:* | 3.3 patch2 | Vulnerable | NetApp |
| cpe:2.3:a:netapp:service_processor:3.3:patch3:*:*:*:*:*:* | 3.3 patch3 | Vulnerable | NetApp |
| cpe:2.3:a:netapp:service_processor:3.3:patch4:*:*:*:*:*:* | 3.3 patch4 | Vulnerable | NetApp |
| cpe:2.3:a:netapp:service_processor:4.1:-:*:*:*:*:*:* | 4.1 | Vulnerable | NetApp |
| cpe:2.3:a:netapp:service_processor:4.1:patch1:*:*:*:*:*:* | 4.1 patch1 | Vulnerable | NetApp |
| cpe:2.3:a:netapp:service_processor:4.1:patch2:*:*:*:*:*:* | 4.1 patch2 | Vulnerable | NetApp |
| cpe:2.3:a:netapp:service_processor:4.1:patch3:*:*:*:*:*:* | 4.1 patch3 | Vulnerable | NetApp |
| cpe:2.3:a:netapp:service_processor:4.1:patch4:*:*:*:*:*:* | 4.1 patch4 | Vulnerable | NetApp |
| cpe:2.3:a:netapp:service_processor:4.1:patch5:*:*:*:*:*:* | 4.1 patch5 | Vulnerable | NetApp |
| cpe:2.3:a:netapp:service_processor:4.1:patch6:*:*:*:*:*:* | 4.1 patch6 | Vulnerable | NetApp |
| cpe:2.3:a:netapp:service_processor:5.1:-:*:*:*:*:*:* | 5.1 | Vulnerable | NetApp |
| cpe:2.3:a:netapp:service_processor:5.1:patch1:*:*:*:*:*:* | 5.1 patch1 | Vulnerable | NetApp |
| cpe:2.3:a:netapp:service_processor:5.1:patch2:*:*:*:*:*:* | 5.1 patch2 | Vulnerable | NetApp |
| cpe:2.3:a:netapp:service_processor:5.1:patch3:*:*:*:*:*:* | 5.1 patch3 | Vulnerable | NetApp |
| cpe:2.3:o:netapp:clustered_data_ontap:9.1:*:*:*:*:*:*:* | 9.1 | Running on | NetApp |
| cpe:2.3:a:netapp:service_processor:2.4:-:*:*:*:*:*:* | 2.4 | Vulnerable | NetApp |
| cpe:2.3:a:netapp:service_processor:3.2:-:*:*:*:*:*:* | 3.2 | Vulnerable | NetApp |
| cpe:2.3:o:netapp:clustered_data_ontap:9.0:*:*:*:*:*:*:* | 9.0 | Running on | NetApp |
| cpe:2.3:a:netapp:service_processor:2.3.2:-:*:*:*:*:*:* | 2.3.2 | Vulnerable | NetApp |
| cpe:2.3:a:netapp:service_processor:2.3.2:patch1:*:*:*:*:*:* | 2.3.2 patch1 | Vulnerable | NetApp |
| cpe:2.3:a:netapp:service_processor:2.3.2:patch2:*:*:*:*:*:* | 2.3.2 patch2 | Vulnerable | NetApp |
| cpe:2.3:a:netapp:service_processor:2.3.2:patch3:*:*:*:*:*:* | 2.3.2 patch3 | Vulnerable | NetApp |
| cpe:2.3:a:netapp:service_processor:3.1.2:-:*:*:*:*:*:* | 3.1.2 | Vulnerable | NetApp |
| cpe:2.3:a:netapp:service_processor:3.1.2:patch1:*:*:*:*:*:* | 3.1.2 patch1 | Vulnerable | NetApp |
| cpe:2.3:a:netapp:service_processor:3.1.2:patch2:*:*:*:*:*:* | 3.1.2 patch2 | Vulnerable | NetApp |
| cpe:2.3:o:netapp:clustered_data_ontap:8.3:*:*:*:*:*:*:* | 8.3 | Running on | NetApp |
| cpe:2.3:a:netapp:service_processor:2.2.5:-:*:*:*:*:*:* | 2.2.5 | Vulnerable | NetApp |
| cpe:2.3:a:netapp:service_processor:3.0.4:-:*:*:*:*:*:* | 3.0.4 | Vulnerable | NetApp |
| cpe:2.3:o:netapp:clustered_data_ontap:8.2:*:*:*:*:*:*:* | 8.2 | Running on | NetApp |
- cpe:2.3:a:netapp:service_processor:3.4:patch2:*:*:*:*:*:* Versions 3.4 patch2 Vulnerable ·NetApp
- cpe:2.3:a:netapp:service_processor:4.2:-:*:*:*:*:*:* Versions 4.2 Vulnerable ·NetApp
- cpe:2.3:a:netapp:service_processor:4.2:patch1:*:*:*:*:*:* Versions 4.2 patch1 Vulnerable ·NetApp
- cpe:2.3:a:netapp:service_processor:4.2:patch2:*:*:*:*:*:* Versions 4.2 patch2 Vulnerable ·NetApp
- cpe:2.3:a:netapp:service_processor:5.2:-:*:*:*:*:*:* Versions 5.2 Vulnerable ·NetApp
- cpe:2.3:a:netapp:service_processor:5.2:patch1:*:*:*:*:*:* Versions 5.2 patch1 Vulnerable ·NetApp
- cpe:2.3:o:netapp:clustered_data_ontap:9.2:*:*:*:*:*:*:* Versions 9.2 Running on ·NetApp
- cpe:2.3:a:netapp:service_processor:2.4.1:-:*:*:*:*:*:* Versions 2.4.1 Vulnerable ·NetApp
- cpe:2.3:a:netapp:service_processor:2.4.1:patch1:*:*:*:*:*:* Versions 2.4.1 patch1 Vulnerable ·NetApp
- cpe:2.3:a:netapp:service_processor:3.3:-:*:*:*:*:*:* Versions 3.3 Vulnerable ·NetApp
- cpe:2.3:a:netapp:service_processor:3.3:patch1:*:*:*:*:*:* Versions 3.3 patch1 Vulnerable ·NetApp
- cpe:2.3:a:netapp:service_processor:3.3:patch2:*:*:*:*:*:* Versions 3.3 patch2 Vulnerable ·NetApp
- cpe:2.3:a:netapp:service_processor:3.3:patch3:*:*:*:*:*:* Versions 3.3 patch3 Vulnerable ·NetApp
- cpe:2.3:a:netapp:service_processor:3.3:patch4:*:*:*:*:*:* Versions 3.3 patch4 Vulnerable ·NetApp
- cpe:2.3:a:netapp:service_processor:4.1:-:*:*:*:*:*:* Versions 4.1 Vulnerable ·NetApp
- cpe:2.3:a:netapp:service_processor:4.1:patch1:*:*:*:*:*:* Versions 4.1 patch1 Vulnerable ·NetApp
- cpe:2.3:a:netapp:service_processor:4.1:patch2:*:*:*:*:*:* Versions 4.1 patch2 Vulnerable ·NetApp
- cpe:2.3:a:netapp:service_processor:4.1:patch3:*:*:*:*:*:* Versions 4.1 patch3 Vulnerable ·NetApp
- cpe:2.3:a:netapp:service_processor:4.1:patch4:*:*:*:*:*:* Versions 4.1 patch4 Vulnerable ·NetApp
- cpe:2.3:a:netapp:service_processor:4.1:patch5:*:*:*:*:*:* Versions 4.1 patch5 Vulnerable ·NetApp
- cpe:2.3:a:netapp:service_processor:4.1:patch6:*:*:*:*:*:* Versions 4.1 patch6 Vulnerable ·NetApp
- cpe:2.3:a:netapp:service_processor:5.1:-:*:*:*:*:*:* Versions 5.1 Vulnerable ·NetApp
- cpe:2.3:a:netapp:service_processor:5.1:patch1:*:*:*:*:*:* Versions 5.1 patch1 Vulnerable ·NetApp
- cpe:2.3:a:netapp:service_processor:5.1:patch2:*:*:*:*:*:* Versions 5.1 patch2 Vulnerable ·NetApp
- cpe:2.3:a:netapp:service_processor:5.1:patch3:*:*:*:*:*:* Versions 5.1 patch3 Vulnerable ·NetApp
- cpe:2.3:o:netapp:clustered_data_ontap:9.1:*:*:*:*:*:*:* Versions 9.1 Running on ·NetApp
- cpe:2.3:a:netapp:service_processor:2.4:-:*:*:*:*:*:* Versions 2.4 Vulnerable ·NetApp
- cpe:2.3:a:netapp:service_processor:3.2:-:*:*:*:*:*:* Versions 3.2 Vulnerable ·NetApp
- cpe:2.3:o:netapp:clustered_data_ontap:9.0:*:*:*:*:*:*:* Versions 9.0 Running on ·NetApp
- cpe:2.3:a:netapp:service_processor:2.3.2:-:*:*:*:*:*:* Versions 2.3.2 Vulnerable ·NetApp
- cpe:2.3:a:netapp:service_processor:2.3.2:patch1:*:*:*:*:*:* Versions 2.3.2 patch1 Vulnerable ·NetApp
- cpe:2.3:a:netapp:service_processor:2.3.2:patch2:*:*:*:*:*:* Versions 2.3.2 patch2 Vulnerable ·NetApp
- cpe:2.3:a:netapp:service_processor:2.3.2:patch3:*:*:*:*:*:* Versions 2.3.2 patch3 Vulnerable ·NetApp
- cpe:2.3:a:netapp:service_processor:3.1.2:-:*:*:*:*:*:* Versions 3.1.2 Vulnerable ·NetApp
- cpe:2.3:a:netapp:service_processor:3.1.2:patch1:*:*:*:*:*:* Versions 3.1.2 patch1 Vulnerable ·NetApp
- cpe:2.3:a:netapp:service_processor:3.1.2:patch2:*:*:*:*:*:* Versions 3.1.2 patch2 Vulnerable ·NetApp
- cpe:2.3:o:netapp:clustered_data_ontap:8.3:*:*:*:*:*:*:* Versions 8.3 Running on ·NetApp
- cpe:2.3:a:netapp:service_processor:2.2.5:-:*:*:*:*:*:* Versions 2.2.5 Vulnerable ·NetApp
- cpe:2.3:a:netapp:service_processor:3.0.4:-:*:*:*:*:*:* Versions 3.0.4 Vulnerable ·NetApp
- cpe:2.3:o:netapp:clustered_data_ontap:8.2:*:*:*:*:*:*:* Versions 8.2 Running on ·NetApp
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2019-5490
- 2026-10-03 Alias added: GHSA-jjg8-x9mh-qvmm
References
More NetApp Service Processor vulnerabilities
- TI-2019-09956 In the Linux kernel before 5.1.17, ptrace_link in kernel/ptrace.c mishandles the… KEVCVSS 3.1HIGH 7.8
- TI-2019-01829 Use after free in Android KEVCVSS 3.1HIGH 7.8
- TI-2018-11033 OpenSSH through 7.7 is prone to a user enumeration vulnerability due to not delaying… CVSS 3.1MEDIUM 5.9
- TI-2016-07072 Uncontrolled resource consumption in OpenSSL CVSS 3.1HIGH 7.5
- TI-2016-08749 sshd in OpenSSH before 7.4 allows remote attackers to cause a denial of service (NULL… CVSS 3.1HIGH 7.5
- TI-2019-01190 0-byte record padding oracle CVSS 3.1MEDIUM 5.9
Sources
- CVE-2019-5490 · CVE Program
- CVE-2019-5490 · NVD
- FIRST EPSS
- GHSA-jjg8-x9mh-qvmm · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences