EN PT-BR
← Voltar ao feed
medium

CERT-FR warns of NetApp FAS/AFF BIOS privilege escalation flaw CVE-2021-42554

1 fonte(s) · 1 atualização(ões) · publicado 28/10/2026 21:00 · coletado há 2 dias

CERT-FR published advisory CERTFR-2026-AVI-1410 on 29 October 2026 about a vulnerability in NetApp products that lets an attacker obtain elevated privileges. The flaw is tracked as CVE-2021-42554 and the advisory relays NetApp bulletin NTAP-20220216-0007 of 28 October 2026. The advisory does not report exploitation, threat actors or attack details. It refers readers to the vendor bulletin for patches.

Entenda a falha

A vulnerabilidade

CVE-2021-42554 is a privilege escalation flaw in the NetApp FAS/AFF BIOS. CERT-FR says it lets an attacker obtain elevated privileges. Affected: A300, 8200, C190, A220, 2720, 2750 and A150 platforms before 308-04120_A0_SERVICE_IMAGE_11.18_S, and A900 and 9500 platforms before 308-04123_A0_SERVICE_IMAGE_18.6. Those BIOS versions are the fixed releases, as listed in NetApp bulletin NTAP-20220216-0007. The advisory does not say what access, authentication or configuration an attacker needs.

Como funciona

The sources do not describe how the vulnerable process works. They do not say which input or event reaches the BIOS, what the BIOS does with it, or at which step it fails. Details, if any, would be in the NetApp bulletin, which is not part of the material available here.

Por que é vulnerável

The root cause is not stated in the CERT-FR advisory. It says only that the flaw leads to privilege escalation and that fixed BIOS service images exist. It does not explain what the fix changes or why the issue went unnoticed.

Como foi descoberta

The sources do not say who found the flaw or how. NetApp published bulletin NTAP-20220216-0007 on 28 October 2026, and CERT-FR relayed it in advisory CERTFR-2026-AVI-1410 on 29 October 2026. The advisory reports no exploitation and no threat actors.

Explicação gerada por IA a partir da matéria e dos artigos, em 30/10/2026 14:21.

Detalhes técnicos

  • Impact: privilege escalation.
  • Affected: NetApp FAS/AFF BIOS for A300, 8200, C190, A220, 2720, 2750 and A150 platforms, in versions before 308-04120_A0_SERVICE_IMAGE_11.18_S.
  • Affected: NetApp FAS/AFF BIOS for A900 and 9500 platforms, in versions before 308-04123_A0_SERVICE_IMAGE_18.6.
  • The advisory gives no details on the attack vector or authentication requirements.

Remediação

  • Apply the BIOS updates listed in NetApp bulletin NTAP-20220216-0007.

Linha do tempo

  1. cert.cyber.gouv.fr ↗ · pub. 28/10/2026 21:00 · coletado 30/10 14:01 primeiro registro

    CERT-FR warns of NetApp FAS/AFF BIOS privilege escalation flaw CVE-2021-42554

    ler a análise desta fonte

    CERT-FR published advisory CERTFR-2026-AVI-1410 on 29 October 2026 about a vulnerability in NetApp products that lets an attacker obtain elevated privileges. The flaw is tracked as CVE-2021-42554 and the advisory relays NetApp bulletin NTAP-20220216-0007 of 28 October 2026. The advisory does not report exploitation, threat actors or attack details. It refers readers to the vendor bulletin for patches.

    Technical Details

    • Impact: privilege escalation.
    • Affected: NetApp FAS/AFF BIOS for A300, 8200, C190, A220, 2720, 2750 and A150 platforms, in versions before 308-04120_A0_SERVICE_IMAGE_11.18_S.
    • Affected: NetApp FAS/AFF BIOS for A900 and 9500 platforms, in versions before 308-04123_A0_SERVICE_IMAGE_18.6.
    • The advisory gives no details on the attack vector or authentication requirements.

    Remediation

    • Apply the BIOS updates listed in NetApp bulletin NTAP-20220216-0007.