CVE-2018-18202

Severity: critical (CVSS 9.8 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.4% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2018-10-10 · updated 2026-06-17

Description

The QLogic 4Gb Fibre Channel 5.5.2.6.0 and 4/8Gb SAN 7.10.1.20.0 modules for IBM BladeCenter have an undocumented support account with a support password, an undocumented diags account with a diags password, and an undocumented prom account with a prom password.

Affected products

IBM Qlogic 20-Port 4/8 Gb San Switch Module Firmware: 7.10.1.20.0
IBM Qlogic 4 Gb Fibre Channel Expansion Card Firmware: 5.5.2.6.0

References

http://misteralfa-hack.blogspot.com/2018/10/ibm-bladecenter-qlogic-4g-fibre-channel.html
http://misteralfa-hack.blogspot.com/2018/10/ibm-bladecenter-qlogic-4g-fibre-channel.html

Get alerted when CVE-2018-18202 or the next vulnerability affects your stack