CVE-2024-13058: Authenticated, non-admin users can create storage pools via the sifi API

Severity: medium (CVSS 4.8 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-12-30 · updated 2026-06-17
Weakness: CWE-269

Description

An issue exists in SoftIron HyperCloud where authenticated, but non-admin users can create data pools, which could potentially impact the performance and availability of the backend software-defined storage subsystem. This issue only impacts SoftIron HyperCloud and related software products (such as VM Squared) software versions 2.3.0 to before 2.5.0.

Affected products

SoftIron HyperCloud: from 2.3.0 before 2.5.0 — fixed in 2.5.0

How to fix

Upgrade to a fixed version: SoftIron HyperCloud 2.5.0. Check the vendor advisory for mitigations.

References

https://advisories.softiron.cloud/

Get alerted when CVE-2024-13058 or the next vulnerability affects your stack