LiveActive security incident?Get immediate response
CVE Record

CVE-2020-8577: SANtricity OS Controller Software versions 11.50.1 and higher are susceptible to a vulnerability which coul...

SANtricity OS Controller Software versions 11.50.1 and higher are susceptible to a vulnerability which could allow an attacker to discover sensitive information by intercepting its transmission within an https session.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

This issue affects E-Series SANtricity OS Controller Software 11.50.1 and higher. The public description says an attacker could discover sensitive information by intercepting transmission within an HTTPS session. Business impact depends on where these storage controllers are deployed and who can observe their management traffic.

Executive priority

Treat this as a targeted storage-management risk until vendor guidance is confirmed. It is not currently supported as actively exploited in the supplied evidence, but information exposure from storage controller management traffic can carry material operational and confidentiality impact.

Technical view

CVE-2020-8577 is an information disclosure vulnerability in SANtricity OS Controller Software. The source bundle provides no CVSS score, CWE, patch version, or detailed attack prerequisites. The stated condition involves interception of data transmitted within an HTTPS session, but the exact protocol weakness is not specified.

Likely exposure

Exposure is limited to environments running E-Series SANtricity OS Controller Software 11.50.1 or higher. Risk is higher where controller management paths traverse shared, untrusted, or poorly segmented networks. The source bundle does not identify internet exposure as a requirement.

Exploitation context

No CISA KEV listing is provided, and the supplied sources do not claim active exploitation or public exploit availability. The public description implies a network interception scenario, but does not provide enough detail to confirm attacker position, authentication needs, or exploit reliability.

Researcher notes

Evidence is sparse: no CVSS, CWE, patch version, or detailed exploitation prerequisites are included. Do not infer affected products beyond E-Series SANtricity OS Controller Software 11.50.1 and higher. Validate findings against NetApp advisory NTAP-20201105-0001.

Mitigation direction

  • Identify all E-Series systems running SANtricity OS Controller Software 11.50.1 or higher.
  • Review the NetApp advisory for official fixed versions or vendor-directed mitigations.
  • Restrict SANtricity management access to trusted administrative networks.
  • Avoid routing management sessions across untrusted or shared network paths.
  • Monitor vendor guidance for updated severity, affected versions, and remediation instructions.

Validation and detection

  • Inventory SANtricity OS Controller Software versions across all E-Series controllers.
  • Confirm whether each system falls within 11.50.1 or higher.
  • Check the NetApp advisory for current remediation status.
  • Review management network segmentation and access paths.
  • Verify logging for unexpected controller management access.
Prepared
Confidence
medium
Sources
3

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2020-8577 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
0Timeline events
0ADP providers
2Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
n/aE-Series SANtricity OS Controller Software11.50.1 and higherListed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.