Broken or risky cryptographic algorithm in Dell Isilon InsightIQ
Priority MEDIUM 44CWE-327Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-327.
Summary
Dell EMC InsightIQ, versions prior to 4.1.4, contain risky cryptographic algorithms in the SSH component. A remote unauthenticated attacker could potentially exploit this vulnerability leading to authentication bypass and remote takeover of the InsightIQ. This allows an attacker to take complete control of InsightIQ to affect services provided by SSH; so Dell recommends customers to upgrade at the earliest opportunity.
Why it matters now
EPSS 0.00834 57th percentileScored 2026-11-07
Fix Fixed Isilon InsightIQ (Dell): 4.1.4
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Dell | Isilon InsightIQ | before 4.1.4 | 4.1.4 | Patch available | CNA |
- Isilon InsightIQ VendorDell Affected before 4.1.4 Fixed in 4.1.4 Patch available CNA
Remediation
- Fix · CNA Isilon InsightIQ (Dell) Fixed in 4.1.4
Timeline
- 2026-10-02 Threatist record created from CVE-2021-36298
- 2026-10-03 Alias added: GHSA-g339-4h86-hr72
References
Sources
- CVE-2021-36298 · CVE Program
- CVE-2021-36298 · NVD
- FIRST EPSS
- GHSA-g339-4h86-hr72 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences