LiveActive security incident?Get immediate response
CVE Record

CVE-2021-20546: IBM Spectrum Protect Client 8.1.0.0 through 8.1.11.0 is vulnerable to a stack-based buffer overflow, caused...

IBM Spectrum Protect Client 8.1.0.0 through 8.1.11.0 is vulnerable to a stack-based buffer overflow, caused by improper bounds checking. A local attacker could overflow a buffer and cause the application to crash. IBM X-Force ID: 198934

MediumCVSS 6.2Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's Takemoderate

Analyst readout for executives and security teams

Plain-English summary

This vulnerability can let someone with local access crash affected IBM Spectrum Protect client software. The public record describes denial of service, not data theft or remote takeover. Business urgency is moderate where this software protects critical backup or storage workflows, because client crashes can disrupt recovery operations.

Executive priority

Treat as a moderate operational risk. It is not described as remotely exploitable, but affected backup or storage management clients can support critical recovery processes. Prioritize remediation on production backup endpoints and systems with broader local-user access.

Technical view

CVE-2021-20546 is a stack-based buffer overflow caused by improper bounds checking in IBM Spectrum Protect Client 8.1.0.0 through 8.1.11.0. The documented impact is a local application crash. CVSS 3.0 score is 6.2, with local attack vector, low complexity, no user interaction, and availability impact only.

Likely exposure

Exposure is limited to hosts running affected IBM Spectrum Protect Client or related Space Management versions 8.1.0.0 through 8.1.11.0. Systems without local user access are less exposed, but backup infrastructure endpoints should still be prioritized.

Exploitation context

The source bundle does not show CISA KEV listing or confirmed active exploitation. IBM X-Force marks exploit maturity as unproven in the supplied CVSS vector. The attack is local and documented impact is application crash.

Researcher notes

The bundle has a naming inconsistency: the description says IBM Spectrum Protect Client, while the affected product field says Spectrum Protect for Space Management. Validate product mapping against IBM's advisory before scoping. No exploit procedure or detailed fix version is provided in the bundle.

Mitigation direction

  • Inventory IBM Spectrum Protect Client and Space Management installations.
  • Identify versions 8.1.0.0 through 8.1.11.0.
  • Review IBM advisory for the vendor-approved fixed level or workaround.
  • Apply IBM-supported updates through normal change control.
  • Restrict local access to systems running affected client software.
  • Monitor for unexpected client crashes on backup-related endpoints.

Validation and detection

  • Confirm installed product name and exact version on each endpoint.
  • Compare versions against the affected 8.1.0.0 through 8.1.11.0 range.
  • Verify remediation status against IBM's advisory, not assumptions.
  • Check endpoint and application logs for repeated client crash events.
  • Document any unresolved hosts with business owner and remediation date.
Prepared
Confidence
medium
Sources
4

Public sources used

Based on public source material and reviewed before publication.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2021-20546 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Medium
CVSS
6.2 (3.0)
Known Exploited
No
Published

Vector: CVSS:3.0/A:H/S:U/I:N/UI:N/AV:L/AC:L/C:N/PR:N/RL:O/RC:C/E:U

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
0Timeline events
0ADP providers
3Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
6.2CVSS 3.0MediumCVSS:3.0/A:H/S:U/I:N/UI:N/AV:L/AC:L/C:N/PR:N/RL:O/RC:C/E:U2.53.6Primary CVE score

Vulnerability scoring details

Base CVSS 3.0 score

6.2Medium
CVSS 3.0 vector shape for CVE-2021-20546Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.0/A:H/S:U/I:N/UI:N/AV:L/AC:L/C:N/PR:N/RL:O/RC:C/E:U

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
IBMSpectrum Protect for Space Management8.1.0.0, 8.1.11.0Listed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.