NetApp FAS 8300/8700 and AFF A400 Baseboard Management Controller (BMC) firmware versions…
Priority LOW 35CWE-1188Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA.
Summary
NetApp FAS 8300/8700 and AFF A400 Baseboard Management Controller (BMC) firmware versions 13.x prior to 13.1P1 were shipped with a default account enabled that could allow unauthorized arbitrary command execution via local access.
Why it matters now
EPSS 0.00581 47th percentileScored 2026-11-07
Fix Fixed NetApp FAS 8300/8700 and AFF A400 Baseboard Management Controller (NetApp): 13.1P1
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| NetApp | NetApp FAS 8300/8700 and AFF A400 Baseboard Management Controller | 13 to before 13.1P1 | 13.1P1 | Patch available | CNA |
- NetApp FAS 8300/8700 and AFF A400 Baseboard Management Controller VendorNetApp Affected 13 to before 13.1P1 Fixed in 13.1P1 Patch available CNA
CPE configurations NVD · 6
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:netapp:fabric-attached_storage_8700_firmware:*:*:*:*:*:*:*:* | up to 13.1 | Vulnerable | NetApp |
| cpe:2.3:h:netapp:fabric-attached_storage_8700:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NetApp |
| cpe:2.3:o:netapp:fabric-attached_storage_8300_firmware:*:*:*:*:*:*:*:* | up to 13.1 | Vulnerable | NetApp |
| cpe:2.3:h:netapp:fabric-attached_storage_8300:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NetApp |
| cpe:2.3:o:netapp:all_flash_fabric-attached_storage_a400_firmware:*:*:*:*:*:*:*:* | up to 13.1 | Vulnerable | NetApp |
| cpe:2.3:h:netapp:all_flash_fabric-attached_storage_a400:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NetApp |
- cpe:2.3:o:netapp:fabric-attached_storage_8700_firmware:*:*:*:*:*:*:*:* Versions up to 13.1 Vulnerable ·NetApp
- cpe:2.3:h:netapp:fabric-attached_storage_8700:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp
- cpe:2.3:o:netapp:fabric-attached_storage_8300_firmware:*:*:*:*:*:*:*:* Versions up to 13.1 Vulnerable ·NetApp
- cpe:2.3:h:netapp:fabric-attached_storage_8300:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp
- cpe:2.3:o:netapp:all_flash_fabric-attached_storage_a400_firmware:*:*:*:*:*:*:*:* Versions up to 13.1 Vulnerable ·NetApp
- cpe:2.3:h:netapp:all_flash_fabric-attached_storage_a400:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp
Remediation
- Fix · CNA NetApp FAS 8300/8700 and AFF A400 Baseboard Management Controller (NetApp) Fixed in 13.1P1
Timeline
- 2026-10-02 Threatist record created from CVE-2019-17274
- 2026-10-03 Alias added: GHSA-hcm2-338g-vfjg
References
More NetApp All Flash Fabric-attached Storage A400 Firmware vulnerabilities
- TI-2020-09538 ntpd in ntp before 4.2.8p14 and 4.3.x before 4.3.100 allows an off-path attacker to block… CVSS 3.1HIGH 7.5
Sources
- CVE-2019-17274 · CVE Program
- CVE-2019-17274 · NVD
- FIRST EPSS
- GHSA-hcm2-338g-vfjg · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences