Read the docs
TI-2021-10525 Aliases CVE-2021-29873GHSA-4j24-8q6f-65hw

IBM Flash System 900 could allow an authenticated attacker to obtain sensitive…

Priority LOW 38Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · None · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

IBM Flash System 900 could allow an authenticated attacker to obtain sensitive information and cause a denial of service due to a restricted shell escape vulnerability. IBM X-Force ID: 206229.

Why it matters now

EPSS 0.01526 74th percentileScored 2026-11-08
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
IBMFlashSystem 9001.6.1.4; 1.5.2.10—No fix listedCNA
IBMFlashSystem V90007.8; 8.4—No fix listedCNA
IBMStorwize V35007.8; 8.4—No fix listedCNA
IBMStorwize V50007.8; 8.4—No fix listedCNA
IBMStorwize V51008.4; 7.8—No fix listedCNA
IBMFlashSystem 9100 Family8.4; 7.8—No fix listedCNA
IBMStorwize V37007.8; 8.4—No fix listedCNA
IBMSAN Volume Controller7.8; 8.4—No fix listedCNA
IBMStorwize V70008.4; 7.8—No fix listedCNA
IBMSpectrum Virtualize Software7.8; 8.4—No fix listedCNA
IBMSpectrum Virtualize for Public Cloud7.8; 8.4—No fix listedCNA
  • FlashSystem 900 VendorIBM Affected 1.6.1.4; 1.5.2.10 Fixed in — No fix listed CNA
  • FlashSystem V9000 VendorIBM Affected 7.8; 8.4 Fixed in — No fix listed CNA
  • Storwize V3500 VendorIBM Affected 7.8; 8.4 Fixed in — No fix listed CNA
  • Storwize V5000 VendorIBM Affected 7.8; 8.4 Fixed in — No fix listed CNA
  • Storwize V5100 VendorIBM Affected 8.4; 7.8 Fixed in — No fix listed CNA
  • FlashSystem 9100 Family VendorIBM Affected 8.4; 7.8 Fixed in — No fix listed CNA
  • Storwize V3700 VendorIBM Affected 7.8; 8.4 Fixed in — No fix listed CNA
  • SAN Volume Controller VendorIBM Affected 7.8; 8.4 Fixed in — No fix listed CNA
  • Storwize V7000 VendorIBM Affected 8.4; 7.8 Fixed in — No fix listed CNA
  • Spectrum Virtualize Software VendorIBM Affected 7.8; 8.4 Fixed in — No fix listed CNA
  • Spectrum Virtualize for Public Cloud VendorIBM Affected 7.8; 8.4 Fixed in — No fix listed CNA

CPE configurations NVD · 12

CPEVersionsRoleVendor
cpe:2.3:a:ibm:spectrum_virtualize:*:*:*:*:*:*:*:*7.8.0.0 to before 8.4.0.0VulnerableIBM
cpe:2.3:a:ibm:spectrum_virtualize_for_public_cloud:*:*:*:*:*:*:*:*7.8.0.0 to before 8.4.0.0VulnerableIBM
cpe:2.3:a:ibm:storwize_v3500_software:*:*:*:*:*:*:*:*7.8.0.0 to before 8.4.0.0VulnerableIBM
cpe:2.3:a:ibm:storwize_v3700_software:*:*:*:*:*:*:*:*7.8.0.0 to before 8.4.0.0VulnerableIBM
cpe:2.3:a:ibm:storwize_v5000_software:*:*:*:*:*:*:*:*7.8.0.0 to before 8.4.0.0VulnerableIBM
cpe:2.3:a:ibm:storwize_v5100_software:*:*:*:*:*:*:*:*7.8.0.0 to before 8.4.0.0VulnerableIBM
cpe:2.3:a:ibm:storwize_v7000_software:*:*:*:*:*:*:*:*7.8.0.0 to before 8.4.0.0VulnerableIBM
cpe:2.3:o:ibm:san_volume_controller_firmware:*:*:*:*:*:*:*:*7.8.0.0 to before 8.4.0.0VulnerableIBM
cpe:2.3:o:ibm:flashsystem_9100_firmware:*:*:*:*:*:*:*:*7.8.0.0 to before 8.4.0.0VulnerableIBM
cpe:2.3:h:ibm:flashsystem_9100:-:*:*:*:*:*:*:*not specified by NVDRunning onIBM
  • cpe:2.3:a:ibm:spectrum_virtualize:*:*:*:*:*:*:*:* Versions 7.8.0.0 to before 8.4.0.0 Vulnerable ·IBM
  • cpe:2.3:a:ibm:spectrum_virtualize_for_public_cloud:*:*:*:*:*:*:*:* Versions 7.8.0.0 to before 8.4.0.0 Vulnerable ·IBM
  • cpe:2.3:a:ibm:storwize_v3500_software:*:*:*:*:*:*:*:* Versions 7.8.0.0 to before 8.4.0.0 Vulnerable ·IBM
  • cpe:2.3:a:ibm:storwize_v3700_software:*:*:*:*:*:*:*:* Versions 7.8.0.0 to before 8.4.0.0 Vulnerable ·IBM
  • cpe:2.3:a:ibm:storwize_v5000_software:*:*:*:*:*:*:*:* Versions 7.8.0.0 to before 8.4.0.0 Vulnerable ·IBM
  • cpe:2.3:a:ibm:storwize_v5100_software:*:*:*:*:*:*:*:* Versions 7.8.0.0 to before 8.4.0.0 Vulnerable ·IBM
  • cpe:2.3:a:ibm:storwize_v7000_software:*:*:*:*:*:*:*:* Versions 7.8.0.0 to before 8.4.0.0 Vulnerable ·IBM
  • cpe:2.3:o:ibm:san_volume_controller_firmware:*:*:*:*:*:*:*:* Versions 7.8.0.0 to before 8.4.0.0 Vulnerable ·IBM
  • cpe:2.3:o:ibm:flashsystem_9100_firmware:*:*:*:*:*:*:*:* Versions 7.8.0.0 to before 8.4.0.0 Vulnerable ·IBM
  • cpe:2.3:h:ibm:flashsystem_9100:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·IBM
Show 2 more CPE
CPEVersionsRoleVendor
cpe:2.3:o:ibm:flashsystem_9000_firmware:*:*:*:*:*:*:*:*7.8.0.0 to before 8.4.0.0VulnerableIBM
cpe:2.3:h:ibm:flashsystem_9000:-:*:*:*:*:*:*:*not specified by NVDRunning onIBM
  • cpe:2.3:o:ibm:flashsystem_9000_firmware:*:*:*:*:*:*:*:* Versions 7.8.0.0 to before 8.4.0.0 Vulnerable ·IBM
  • cpe:2.3:h:ibm:flashsystem_9000:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·IBM

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-29873
  2. 2026-10-03 Alias added: GHSA-4j24-8q6f-65hw

References

Patch 2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences