CVE-2021-29873

Severity: high (CVSS 8.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-10-21 · updated 2026-06-17

Description

IBM Flash System 900 could allow an authenticated attacker to obtain sensitive information and cause a denial of service due to a restricted shell escape vulnerability. IBM X-Force ID: 206229.

Affected products

IBM Flashsystem 9000 Firmware: from 7.8.0.0 before 8.4.0.0 — fixed in 8.4.0.0
IBM Flashsystem 9100 Firmware: from 7.8.0.0 before 8.4.0.0 — fixed in 8.4.0.0
IBM San Volume Controller Firmware: from 7.8.0.0 before 8.4.0.0 — fixed in 8.4.0.0
IBM Spectrum Virtualize: from 7.8.0.0 before 8.4.0.0 — fixed in 8.4.0.0
IBM Spectrum Virtualize for Public Cloud: from 7.8.0.0 before 8.4.0.0 — fixed in 8.4.0.0
IBM Storwize V3500 Software: from 7.8.0.0 before 8.4.0.0 — fixed in 8.4.0.0
IBM Storwize V3700 Software: from 7.8.0.0 before 8.4.0.0 — fixed in 8.4.0.0
IBM Storwize V5000 Software: from 7.8.0.0 before 8.4.0.0 — fixed in 8.4.0.0
IBM Storwize V5100 Software: from 7.8.0.0 before 8.4.0.0 — fixed in 8.4.0.0
IBM Storwize V7000 Software: from 7.8.0.0 before 8.4.0.0 — fixed in 8.4.0.0

How to fix

Upgrade to a fixed version: IBM Flashsystem 9000 Firmware 8.4.0.0; IBM Flashsystem 9100 Firmware 8.4.0.0; IBM San Volume Controller Firmware 8.4.0.0; IBM Spectrum Virtualize 8.4.0.0; IBM Spectrum Virtualize for Public Cloud 8.4.0.0; IBM Storwize V3500 Software 8.4.0.0; IBM Storwize V3700 Software 8.4.0.0; IBM Storwize V5000 Software 8.4.0.0; IBM Storwize V5100 Software 8.4.0.0; IBM Storwize V7000 Software 8.4.0.0. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2021-29873 or the next vulnerability affects your stack