{"id":"CVE-2020-5328","published":"2020-03-06T20:25:14Z","modified":"2024-09-16T18:29:46Z","title":"Dell EMC Isilon OneFS versions prior to 8.2.0 contain an unauthorized access vulnerability due to a lack of thorough…","vendor":"Dell","product":"Isilon OneFS","tier":"core","eol":null,"affectedVersions":[{"vendor":"Dell","product":"Isilon OneFS","versions":[">= unspecified, < 8.2.0"]}],"description":{"text":"Dell EMC Isilon OneFS versions prior to 8.2.0 contain an unauthorized access vulnerability due to a lack of thorough authorization checks when SyncIQ is licensed, but encrypted syncs are not marked as required. When this happens, loss of control of the cluster can occur.","provenance":"source","from":"CVE.org"},"summary":{"text":"Dell EMC Isilon OneFS (prior to 8.2.0) has a missing authorization check in its SyncIQ replication component, which is exercised when SyncIQ is licensed but encrypted syncs are not marked as required. An attacker who can reach the cluster over the network, without needing credentials or any user interaction, can gain unauthorized access that may lead to loss of control of the cluster.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:16:33Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.01387,"percentile":0.72267,"date":"2026-10-31","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":null,"cwes":[{"id":"CWE-306","name":"Missing Authentication for Critical Functionality"}],"references":[{"url":"https://www.dell.com/support/security/en-us/details/541423/DSA-2020-039-Dell-EMC-Isilon-OneFS-Security-Update-for-a-SyncIQ-Vulnerability","tags":["x_refsource_MISC"]}],"techniques":[{"id":"T1068","name":"Exploitation for Privilege Escalation","tactics":["privilege-escalation"],"provenance":"source","basis":"ctid-cve","bases":["ctid-cve"],"basisDetail":"CTID attack_to_cve (Phase 2)","mappingType":"secondary_impact","evidence":[],"confidence":"high"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2020-26510","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-26510","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[{"stage":"secondary","techniques":["T1068"],"provenance":"source"}],"timeline":[{"date":"2020-03-06","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2020-5328","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":21.3,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":14.45,"detail":"percentile 0.7227"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}