CVE-2024-21990: Default Privileged Account Credentials Vulnerability in ONTAP Select Deploy administration utility

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-04-17 · updated 2026-06-17
Weakness: CWE-259

Description

ONTAP Select Deploy administration utility versions 9.12.1.x, 9.13.1.x and 9.14.1.x contain hard-coded credentials that could allow an attacker to view Deploy configuration information and modify the account credentials.

Affected products

NetApp ONTAP Select Deploy administration utility: from 9.12.1 through 9.14.1

References

https://security.netapp.com/advisory/ntap-20240411-0002/
https://security.netapp.com/advisory/ntap-20240411-0002/

Get alerted when CVE-2024-21990 or the next vulnerability affects your stack