CVE-2021-20740

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-06-28 · updated 2026-06-17
Weakness: CWE-78

Description

Hitachi Virtual File Platform Versions prior to 5.5.3-09 and Versions prior to 6.4.3-09, and NEC Storage M Series NAS Gateway Nh4a/Nh8a versions prior to FOS 5.5.3-08(NEC2.5.4a) and Nh4b/Nh8b, Nh4c/Nh8c versions prior to FOS 6.4.3-08(NEC3.4.2) allow remote authenticated attackers to execute arbitrary OS commands with root privileges via unspecified vectors.

Affected products

Hitachi Virtual File Platform: before 6.4.3-09; before 5.5.3-09 — fixed in 5.5.3-09, 6.4.3-09
NEC Nas Gateway Nh4A Firmware: before fos_5.5.3-08\(nec2.5.4a\) — fixed in fos_5.5.3-08\(nec2.5.4a\)
NEC Nas Gateway Nh4B Firmware: before fos_6.4.3-08\(nec3.4.2\) — fixed in fos_6.4.3-08\(nec3.4.2\)
NEC Nas Gateway Nh4C Firmware: before fos_6.4.3-08\(nec3.4.2\) — fixed in fos_6.4.3-08\(nec3.4.2\)
NEC Nas Gateway Nh8A Firmware: before fos_5.5.3-08\(nec2.5.4a\) — fixed in fos_5.5.3-08\(nec2.5.4a\)
NEC Nas Gateway Nh8B Firmware: before fos_6.4.3-08\(nec3.4.2\) — fixed in fos_6.4.3-08\(nec3.4.2\)
NEC Nas Gateway Nh8C Firmware: before fos_6.4.3-08\(nec3.4.2\) — fixed in fos_6.4.3-08\(nec3.4.2\)

How to fix

Upgrade to a fixed version: Hitachi Virtual File Platform 5.5.3-09, 6.4.3-09; NEC Nas Gateway Nh4A Firmware fos_5.5.3-08\(nec2.5.4a\); NEC Nas Gateway Nh4B Firmware fos_6.4.3-08\(nec3.4.2\); NEC Nas Gateway Nh4C Firmware fos_6.4.3-08\(nec3.4.2\); NEC Nas Gateway Nh8A Firmware fos_5.5.3-08\(nec2.5.4a\); NEC Nas Gateway Nh8B Firmware fos_6.4.3-08\(nec3.4.2\); NEC Nas Gateway Nh8C Firmware fos_6.4.3-08\(nec3.4.2\). Check the vendor advisory for mitigations.

References

Get alerted when CVE-2021-20740 or the next vulnerability affects your stack