Spectrum Protect Plus

Vendor:

First CVE: Sep 26, 2018 · Active for 7 years

44

Total CVEs

More Total CVEs than 98% of tracked products

7.3

Avg CVEs / Year

Higher CVE frequency than 94% of tracked products

7.1

Avg CVSS

Higher Avg CVSS than 45% of tracked products

0.0%

KEV Rate

Bottom 1%

Trends Over Time

The number and severity of CVEs published that impact Spectrum Protect Plus over time

Volume of CVEsAvg CVSS Base Score

First CVE

Sep 26, 2018

7 years ago

Most Recent CVE

Feb 2, 2024

907 days ago

CVE Severity & Scoring

Spectrum Protect Plus44 CVEs

52%

36%

11%

All CVEs353,240 CVEs

45%

40%

11%

MediumHighCritical

Attack Vector

Local10 (22.7%)

Network33 (75.0%)

Unknown0 (0.0%)

Physical0 (0.0%)

Adjacent Network1 (2.3%)

Attack Complexity

Low38 (86.4%)

High6 (13.6%)

Unknown0 (0.0%)

User Interaction

None40 (90.9%)

Unknown0 (0.0%)

Required4 (9.1%)

Privileges Required

Low16 (36.4%)

High2 (4.5%)

None26 (59.1%)

Unknown0 (0.0%)

Top CVEs

Signals from CVEs in this product scope (44 CVEs).

44 CVEs · Highest risk first

CVE	Published	CVSS	Risk	KEV	Exploit
CVE-2020-4241HIGH IBM Spectrum Scale and IBM Spectrum Protect Plus 10.1.0 through 10.1.5 could allow a remote authenticated attacker to execute arbitrary commands on the system. By sending a special	Mar 31, 2020	8.8	57	NO	NO
CVE-2020-4208CRITICAL IBM Spectrum Protect Plus 10.1.0 through 10.1.5 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound	Mar 31, 2020	9.8	32	NO	NO
CVE-2020-4469CRITICAL IBM Spectrum Protect Plus 10.1.0 through 10.1.5 could allow a remote attacker to execute arbitrary code on the system. By using a specially crafted HTTP command, an attacker could	Jun 15, 2020	9.8	30	NO	NO
CVE-2020-4216CRITICAL IBM Spectrum Protect Plus 10.1.0 through 10.1.5 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound	Jun 15, 2020	9.8	30	NO	NO
CVE-2020-4206HIGH IBM Spectrum Protect Plus 10.1.0 through 10.1.5 could allow a remote attacker to execute arbitrary commands on the system in the context of root user, caused by improper validation	Mar 31, 2020	8.8	29	NO	NO
CVE-2020-4703HIGH IBM Spectrum Protect Plus 10.1.0 through 10.1.6 Administrative Console could allow an authenticated attacker to upload arbitrary files which could be execute arbitrary code on the	Sep 15, 2020	8.0	27	NO	NO
CVE-2022-40608HIGH IBM Spectrum Protect Plus 10.1.6 through 10.1.11 Microsoft File Systems restore operation can download any file on the target machine by manipulating the URL with a directory trave	Sep 19, 2022	7.5	26	NO	NO
CVE-2020-4470HIGH IBM Spectrum Protect Plus 10.1.0 through 10.1.5 Administrative Console could allow an authenticated attacker to upload arbitrary files which could be execute arbitrary code on the	Jun 15, 2020	8.0	26	NO	NO
CVE-2022-22396HIGH Credentials are printed in clear text in the IBM Spectrum Protect Plus 10.1.0.0 through 10.1.9.3 virgo log file in certain cases. Credentials could be the remote vSnap, offload tar	Jun 6, 2022	7.5	25	NO	NO
CVE-2022-22354HIGH IBM Spectrum Protect Plus 10.1.0.0 through 10.1.9.2 and IBM Spectrum Copy Data Management 2.2.0.0 through 2.2.14.3 do not limit the length of a connection which could allow for a S	Mar 14, 2022	7.5	25	NO	NO

View all 44 CVEs →

Exploit Exposure

Signals from CVEs in this product scope (44 CVEs).

CISA KEV

0 CVEs

0.0% of CVEs· Bottom 1%

Metasploit

0 CVEs

0.0% of CVEs· Bottom 1%

Nuclei

0 CVEs

0.0% of CVEs· Bottom 1%

ExploitDB

0 CVEs

0.0% of CVEs· Bottom 1%

Social Chatter

Signals from CVEs in this product scope (44 CVEs).

Media Mentions

Signals from CVEs in this product scope (44 CVEs).

Top CNAs Publishing CVEs For Spectrum Protect Plus

Top CWEs

Versions

Version	CVE Count	Avg CVSS	Avg EPSS
10.1.7	1	6.2	0.3%
10.1.6	1	6.2	0.3%
10.1.3	2	6.7	0.4%
10.1.2	2	6.7	0.4%
10.1.1	3	7.1	0.4%
10.1.0	1	7.8	0.4%