CVE-2020-29502
📋 TL;DR
Dell EMC PowerStore versions before 1.0.3.0.5.007 store passwords in plain text, allowing locally authenticated attackers to read sensitive credentials. This affects PowerStore X & T environments where an attacker with local access could compromise user accounts. The exposed credentials could be used to access the application with the privileges of the compromised account.
💻 Affected Systems
- Dell EMC PowerStore X
- Dell EMC PowerStore T
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
An attacker gains administrative credentials, leading to complete system compromise, data exfiltration, or ransomware deployment.
Likely Case
Local users or attackers with initial access escalate privileges by reading stored credentials, potentially gaining unauthorized application access.
If Mitigated
With proper access controls and monitoring, impact is limited to credential exposure without successful exploitation.
🎯 Exploit Status
Exploitation requires local access to read stored plain-text passwords. No public exploit code is known.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.0.3.0.5.007 or later
Vendor Advisory: https://www.dell.com/support/kbdoc/000180775
Restart Required: Yes
Instructions:
1. Backup system configuration and data. 2. Download PowerStore OS 1.0.3.0.5.007 or later from Dell support. 3. Apply the update following Dell's upgrade procedures. 4. Verify the update completed successfully. 5. Restart the system if not done automatically.
🔧 Temporary Workarounds
Restrict Local Access
allLimit local system access to trusted administrators only to reduce attack surface.
Monitor Access Logs
allImplement strict monitoring of local authentication and file access attempts.
🧯 If You Can't Patch
- Implement strict access controls to limit who can authenticate locally to PowerStore systems.
- Deploy monitoring and alerting for suspicious local access patterns or credential misuse.
🔍 How to Verify
Check if Vulnerable:
Check PowerStore OS version via the management interface or CLI. If version is below 1.0.3.0.5.007, the system is vulnerable.Check Version:
From PowerStore CLI: 'show version' or check via PowerStore Manager web interface.Verify Fix Applied:
After patching, verify the OS version is 1.0.3.0.5.007 or higher and test that passwords are no longer stored in plain text.📡 Detection & Monitoring
Log Indicators:
- Unusual local authentication attempts
- Access to credential storage files
- Failed privilege escalation attempts
Network Indicators:
- Unusual outbound connections from PowerStore systems following local access
SIEM Query:
source="PowerStore" AND (event_type="local_auth" OR file_access="*password*")