Read the docs
TI-2023-24129 Aliases CVE-2023-45084GHSA-4rj3-h5c4-jprh

Media caddy removal and reinsertion without reboot may cause data loss

Priority LOW 30CWE-820Published · Updated

Key facts

Attack vector
Physical
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

An issue exists in SoftIron HyperCloud where drive caddy removal and reinsertion without a reboot may erroneously cause the system to recognize the caddy as new media and wipe all data on the drives due to a missing synchronization flaw, which impacts data availability and integrity. This issue only impacts SoftIron HyperCloud "density" storage nodes running HyperCloud software versions 1.0 to before 2.0.3.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00224 13th percentileScored 2026-11-07
Fix Fixed HyperCloud (SoftIron): 2.0.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
SoftIronHyperCloud1.0 to before 2.0.32.0.3Patch availableCNA
  • HyperCloud VendorSoftIron Affected 1.0 to before 2.0.3 Fixed in 2.0.3 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:softiron:hypercloud:*:*:*:*:*:*:*:*1.0 to before 2.0.3VulnerableSoftIron
  • cpe:2.3:a:softiron:hypercloud:*:*:*:*:*:*:*:* Versions 1.0 to before 2.0.3 Vulnerable ·SoftIron

Remediation

  • Fix · CNA HyperCloud (SoftIron) Fixed in 2.0.3

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    SoftIron HyperCloud 2.0.3

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    • TI-2023-24130 When compute hosts are disabled and reenabled, they immediately transition to "ON", not "INIT"Priority LOW 15
    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-45084
  2. 2026-10-03 Alias added: GHSA-4rj3-h5c4-jprh

References

Other 1

  • TI-2023-24128 HyperCloud: "admin" and "serveradmin" users can be deleted CVSS 3.1MEDIUM 4.4
  • TI-2023-24130 When compute hosts are disabled and reenabled, they immediately transition to "ON", not "INIT" CVSS 3.1LOW 3.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences