CVE-2024-21990

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

ONTAP Select Deploy administration utility versions 9.12.1.x, 9.13.1.x and 9.14.1.x contain hard-coded credentials that could allow an attacker to view Deploy configuration information and modify the account credentials.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-259CWE-798

Affected software

VendorProductVersions
NetAppONTAP Select Deploy administration utility>= 9.12.1, <= 9.14.1P2
netappclustered_data_ontap9.12.1
netappclustered_data_ontap9.13.1
netappclustered_data_ontap9.14.0

References

Timeline

Published
Apr 17, 2024
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2024

CVE-2024-219936.5SnapCenter versions prior to 5.0p1 are susceptible to a vulnerability which could allow an authenticated attacker to discover plaintext crCVE-2024-219944.3StorageGRID (formerly StorageGRID Webscale) versions prior to 11.9 are susceptible to a Denial of Service (DoS) vulnerability. Successful exCVE-2024-22006.1The Contact Form by BestWebSoft plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘cntctfrm_contact_subject’ paraCVE-2024-220027.8CORSAIR iCUE 5.9.105 with iCUE Murals on Windows allows unprivileged users to insert DLL files in the cuepkg-1.2.6 subdirectory of the instaCVE-2024-220047.7Due to length check, an attacker with privilege access on a Linux Nonsecure operating system can trigger a vulnerability and leak the secureCVE-2024-220058.4there is a possible Authentication Bypass due to improperly used crypto. This could lead to local escalation of privilege with no additionalCVE-2024-220065.3OOB read in the TMU plugin that allows for memory disclosure in the power management subsystem of the device.CVE-2024-220076.2In constraint_check of fvp.c, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disCVE-2024-220087.8In config_gov_time_windows of tmu.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalatCVE-2024-220097.1In init_data of , there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege wiCVE-2024-22014.7A cross-privilege Spectre v2 vulnerability allows attackers to bypass all deployed mitigations, including the recent Fine(IBT), and to leak CVE-2024-220105.5In dvfs_plugin_caller of fvp.c, there is a possible out of bounds read due to a missing bounds check. This could lead to local information d
CVE-2024-21990: Critical severity, CVSS 9.8 | Vulnix