Read the docs
TI-2020-17710 Aliases CVE-2020-29489GHSA-8xmx-4f3h-rv3w

Incorrect default permissions in Dell Unity

Priority LOW 29CWE-276Published · Updated

Key facts

Attack vector
Local
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-312.

Summary

Dell EMC Unity, Unity XT, and UnityVSA versions prior to 5.0.4.0.5.012 contains a plain-text password storage vulnerability. A user credentials (including the Unisphere admin privilege user) password is stored in a plain text in a system file. A local authenticated attacker with access to the system files may use the exposed password to gain access with the privileges of the compromised user.

Why it matters now

EPSS 0.00166 5th percentileScored 2026-11-07
Fix Fixed Unity (Dell): 5.0.4.0.5.012

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
DellUnitybefore 5.0.4.0.5.0125.0.4.0.5.012Patch availableCNA
  • Unity VendorDell Affected before 5.0.4.0.5.012 Fixed in 5.0.4.0.5.012 Patch available CNA

CPE configurations NVD · 3

CPEVersionsRoleVendor
cpe:2.3:a:dell:emc_unity_operating_environment:*:*:*:*:*:*:*:*before 5.0.4.0.5.012VulnerableDell
cpe:2.3:a:dell:emc_unity_vsa_operating_environment:*:*:*:*:*:*:*:*before 5.0.4.0.5.012VulnerableDell
cpe:2.3:a:dell:emc_unity_xt_operating_environment:*:*:*:*:*:*:*:*before 5.0.4.0.5.012VulnerableDell
  • cpe:2.3:a:dell:emc_unity_operating_environment:*:*:*:*:*:*:*:* Versions before 5.0.4.0.5.012 Vulnerable ·Dell
  • cpe:2.3:a:dell:emc_unity_vsa_operating_environment:*:*:*:*:*:*:*:* Versions before 5.0.4.0.5.012 Vulnerable ·Dell
  • cpe:2.3:a:dell:emc_unity_xt_operating_environment:*:*:*:*:*:*:*:* Versions before 5.0.4.0.5.012 Vulnerable ·Dell

Remediation

  • Fix · CNA Unity (Dell) Fixed in 5.0.4.0.5.012

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Dell Unity 5.0.4.0.5.012

    3 records Highest priority Priority LOW 3 LOW

    Other records, highest priority first

    • TI-2020-17711 Uncontrolled resource consumption in Dell UnityPriority LOW 36
    • TI-2020-16025 Sensitive information in log files in Dell UnityPriority LOW 29
    Show all 3 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-29489
  2. 2026-10-03 Alias added: GHSA-8xmx-4f3h-rv3w

References

Advisory 1

  • TI-2021-14655 OS command injection in Dell VNX2 CVSS 3.1CRITICAL 9.8
  • TI-2018-01098 XML external entity injection in Dell EMC Unisphere for VMAX Virtual Appliance, Dell EMC… CVSS 3.0CRITICAL 9.8
  • TI-2021-14660 Dell VNX2 OE for File versions 8.1.21.266 and earlier, contain an authentication bypass… CVSS 3.1CRITICAL 9.8
  • TI-2021-14656 Path traversal in Dell VNX2 CVSS 3.1CRITICAL 9.1
  • TI-2021-14662 OS command injection in Dell VNX Control Station CVSS 3.1HIGH 7.2
  • TI-2021-14661 OS command injection in Dell VNX Control Station CVSS 3.1HIGH 7.2
See all 23 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences