Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

NetApp OnCommand Unified Manager allows remote code execution

CVE-2016-6667 · published 9 years ago
Summary

A built-in administrator account in NetApp OnCommand Unified Manager for Clustered Data ONTAP ships with a default password. An attacker who discovers this can log in from anywhere and run any program on the system, potentially taking control of your storage environment. Change or disable the default account and apply the latest software updates to close the risk.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
netapp oncommand_unified_manager_for_clustered_data_ontap 6.3
6.4
cpe:2.3:a:netapp:oncommand_unified_manager_for_clustered_data_ontap:6.3:*:*:*:*:*:*:*
Original advisory text
NetApp OnCommand Unified Manager for Clustered Data ONTAP 6.3 through 6.4P1 contain a default privileged account, which allows remote attackers to execute arbitrary code via unspecified vectors.
NetApp OnCommand Unified Manager for Clustered Data ONTAP 6.3 through 6.4P1 contain a default privileged account, which allows remote attackers to execute arbitrary code via unspecified vectors.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker full control (estimated)
Severity
9.8 Critical
Exploitation
3% chance of attack within 30 days
Timeline
Published7 Feb 2017
Updated30 Oct 2026
First seen29 Sep 2026
Sources
CVE-2016-6667 · NVD
Track software like this
Free during beta