CVE-2020-29127 – This vulnerability allows authentication bypass... (How to Fix)

Q: What is the severity of CVE-2020-29127?

CVE-2020-29127 has a CVSS score of 9.8 (CRITICAL). This vulnerability allows authentication bypass on Fujitsu Eternus Storage DX200 S4 devices. After a root user logs into the web portal, attackers can access the portal with root privileges from different browsers using a specific URI. This affects all users of these storage devices through November 25, 2020.

📋 TL;DR

This vulnerability allows authentication bypass on Fujitsu Eternus Storage DX200 S4 devices. After a root user logs into the web portal, attackers can access the portal with root privileges from different browsers using a specific URI. This affects all users of these storage devices through November 25, 2020.

💻 Affected Systems

Products:

Fujitsu Eternus Storage DX200 S4

Versions: All versions through 2020-11-25

Operating Systems: Device-specific firmware

Default Config Vulnerable: ⚠️ Yes

Notes: Requires web portal access and a root user to have logged in first, but then allows bypass from any browser.

📦 What is this software?

Eternus Storage Dx200 S4 Firmware by Fujitsu

View all CVEs affecting Eternus Storage Dx200 S4 Firmware →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete compromise of storage system allowing data theft, destruction, or ransomware deployment with root-level access.

🟠

Likely Case

Unauthorized access to sensitive storage configuration, data management, and potential data exfiltration.

🟢

If Mitigated

Limited impact if network segmentation prevents external access and strong authentication controls are in place.

🌐 Internet-Facing: HIGH - Web portal accessible from internet would allow remote exploitation without authentication.

🏢 Internal Only: HIGH - Even internal attackers could exploit this to gain root access to critical storage infrastructure.

🎯 Exploit Status

Public PoC: ⚠️ Yes

Weaponized: LIKELY

Unauthenticated Exploit: ✅ No

Complexity: LOW

Exploit requires knowledge of the specific URI pattern but is trivial to execute once known. Requires initial root login session.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Versions after 2020-11-25

Vendor Advisory: https://www.first.org/members/teams/fujitsu_psirt

Restart Required: Yes

Instructions:

1. Contact Fujitsu support for latest firmware. 2. Backup configuration. 3. Apply firmware update. 4. Restart device. 5. Verify fix by testing authentication bypass.

🔧 Temporary Workarounds

Network Segmentation

all

Restrict access to storage management interface to trusted networks only

Session Management

all

Implement strict session timeout policies and require re-authentication for sensitive operations

🧯 If You Can't Patch

Isolate storage management interface behind VPN with multi-factor authentication
Implement network monitoring for unauthorized access attempts to the management portal

🔍 How to Verify

Check if Vulnerable:

Test if accessing cgi-bin/csp?cspid={any_id}&csppage=cgi_PgOverview&csplang=en from different browser after root login grants access.

Check Version:

Check firmware version in web portal under System Information or via CLI: show version

Verify Fix Applied:

After patching, attempt the same bypass technique - should result in authentication prompt or access denial.

📡 Detection & Monitoring

Log Indicators:

Multiple successful logins from different IPs/browsers in short timeframe
Access to cgi-bin/csp URIs without preceding authentication logs

Network Indicators:

HTTP requests to /cgi-bin/csp with cspid parameter from unauthorized sources

SIEM Query:

source="web_logs" AND uri="/cgi-bin/csp" AND NOT user="root" | stats count by src_ip

📊 Metadata

CVE ID: CVE-2020-29127

CVSS v3 Score: 9.8 (CRITICAL)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-287

Published: November 30, 2020

Last Updated: November 21, 2024

🔗 References

http://packetstormsecurity.com/files/160255/Fujitsu-Eternus-Storage-DX200-S4-Broken-Authentication.html Exploit,Third Party Advisory,VDB Entry
https://cxsecurity.com/issue/WLB-2020110215 Exploit,Third Party Advisory
https://seccops.com/fujitsu-eternus-storage-dx200-s4-broken-authentication/ Third Party Advisory
https://www.first.org/members/teams/fujitsu_psirt Third Party Advisory
http://packetstormsecurity.com/files/160255/Fujitsu-Eternus-Storage-DX200-S4-Broken-Authentication.html Exploit,Third Party Advisory,VDB Entry
https://cxsecurity.com/issue/WLB-2020110215 Exploit,Third Party Advisory
https://seccops.com/fujitsu-eternus-storage-dx200-s4-broken-authentication/ Third Party Advisory
https://www.first.org/members/teams/fujitsu_psirt Third Party Advisory

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2020-29127, you might also want to check these: