CVE-2024-0005

An attacker with administrative privileges can deliver a specially crafted SNMP configuration that leads to execution of arbitrary system commands on the device. The vulnerability results from insufficient validation or sanitization of input data passed in the SNMP configuration (CWE-77: Improper Neutralization of Special Elements used in a Command). The attack vector is network-based, does not require user interaction, and the impact includes a different system scope (Scope: Changed).

Successful exploitation of the vulnerability allows an attacker to remotely execute arbitrary commands with potential takeover of full device control, resulting in loss of confidentiality, integrity, and availability of data and system.

Apply patches available from the manufacturer according to references published at https://purestorage.com/security. Additionally, it is recommended to restrict administrative access to device management interfaces and control access to SNMP configuration only to trusted hosts.

Pure Storage Purity//FA (FlashArray) and Purity//FB (FlashBlade) — specific versions indicated in manufacturer references (https://purestorage.com/security)