EUVD-2026-34183
GHSA-5v33-qmw6-v5h3
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (netapp) · only source for this CVE.
CVSS VectorVendor: netapp
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
Active IQ Config Advisor version 6.7.3 contains hard-coded credentials that could allow an authenticated attacker with low privileges to perform unauthorized AutoSupport operations.
AnalysisAI
Hard-coded credentials in NetApp Active IQ Config Advisor 6.7.3 enable authenticated low-privileged attackers to perform unauthorized AutoSupport operations against connected NetApp infrastructure. The embedded credentials bypass intended access controls, allowing any account holder to trigger or manipulate AutoSupport telemetry functions beyond their assigned privilege level. No public exploit code exists and this vulnerability has not been added to the CISA KEV catalog at time of analysis.
Technical ContextAI
Active IQ Config Advisor is a NetApp diagnostic and configuration tool used to validate and assess NetApp storage environments. AutoSupport is NetApp's built-in telemetry and case-management protocol that transmits system health data, event logs, and configuration details to NetApp support infrastructure. The CPE string (cpe:2.3:a:netapp:active_iq_config_advisor:*:*:*:*:*:*:*:*) uses a wildcard version, but the description specifically identifies version 6.7.3. The root cause is the embedding of static, unchangeable credentials within the application binary or configuration - a hard-coded credential weakness (commonly mapped to CWE-798, though the NVD entry lists CWE as N/A). These credentials, once discovered via reverse engineering or binary analysis, can be reused by any authenticated user to invoke AutoSupport functions without proper authorization. The CVSS 4.0 vector shows zero impact on the vulnerable system itself (VC:N/VI:N/VA:N) but Low confidentiality impact on subsequent systems (SC:L), indicating the hard-coded credentials affect downstream NetApp support infrastructure rather than the Config Advisor host itself.
RemediationAI
Consult the NetApp advisory at https://security.netapp.com/advisory/ntap-20260603-0001 for the official patched release - no specific fixed version number is confirmed in the available input data, so citing an exact upgrade target is not possible without vendor advisory review. As an immediate compensating control, restrict access to Active IQ Config Advisor to only users who require AutoSupport operational privileges, reducing the pool of potential abusers of the hard-coded credentials. If AutoSupport is not required in a given environment, consider disabling it within Config Advisor to remove the vulnerable code path entirely; note that disabling AutoSupport will prevent automated case creation and proactive health monitoring from NetApp. Network-layer controls - such as firewall rules blocking outbound AutoSupport traffic (HTTPS to support.netapp.com on port 443) - can limit the downstream impact by preventing unauthorized AutoSupport submissions from reaching NetApp infrastructure, though this will also block legitimate support telemetry.
Same weakness CWE-259 – Use of Hard-coded Password
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today