What’s Vulnerable › Vulnerabilities

CVE-2012-2166

• Severity: critical (CVSS 9.8 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2018-02-08 · updated 2026-06-16
• Weakness: CWE-798

Description

IBM XIV Storage System 2810-A14 and 2812-A14 devices before level 10.2.4.e-2 and 2810-114 and 2812-114 devices before level 11.1.1 have hardcoded passwords for unspecified accounts, which allows remote attackers to gain user access via unknown vectors. IBM X-Force ID: 75041.

Affected products

• IBM Xiv Storage System 2810-114 Firmware: before 11.1.1 — fixed in 11.1.1
• IBM Xiv Storage System 2810-A14 Firmware: before 10.2.4.e-2 — fixed in 10.2.4.e-2
• IBM Xiv Storage System 2812-114 Firmware: before 11.1.1 — fixed in 11.1.1
• IBM Xiv Storage System 2812-A14 Firmware: before 10.2.4.e-2 — fixed in 10.2.4.e-2

How to fix

Upgrade to a fixed version: IBM Xiv Storage System 2810-114 Firmware 11.1.1; IBM Xiv Storage System 2810-A14 Firmware 10.2.4.e-2; IBM Xiv Storage System 2812-114 Firmware 11.1.1; IBM Xiv Storage System 2812-A14 Firmware 10.2.4.e-2. Check the vendor advisory for mitigations.

References

• http://www-01.ibm.com/support/docview.wss?uid=ssg1S1004256
• https://exchange.xforce.ibmcloud.com/vulnerabilities/75041
• http://www-01.ibm.com/support/docview.wss?uid=ssg1S1004256
• https://exchange.xforce.ibmcloud.com/vulnerabilities/75041

Get alerted when CVE-2012-2166 or the next vulnerability affects your stack