LiveActive security incident?Get immediate response
CVE Record

CVE-2021-33895: ETINET BACKBOX E4.09 and H4.09 mismanages password access control.

ETINET BACKBOX E4.09 and H4.09 mismanages password access control. When a user uses the User ID of the process running BBSV to login to the Backbox UI application, the system procedure (USER_AUTHENTICATE_) used for verifying the Password returns 0 (no error). The reason is that the user is not running the XYGate application. Hence, BBSV assumes the Password is correct. For H4.09, the affected version isT0954V04^AAO. For E4.09, the affected version is 22SEP2020. Note: If your current version is E4.10-16MAY2021 (version procedure T9999V04_16MAY2022_BPAKETI_10), a hotfix (FIXPAK-19OCT-2022) is available in version E4.10-19OCT2022. Resolution to CVE-2021-33895 in version E4.11-19OCT2022

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

Certain ETINET BACKBOX versions can mishandle password verification for the BBSV process identity, causing the system to treat a password as valid. Sources do not provide CVSS scoring or exploitation evidence. Organizations running affected Backbox versions should prioritize version verification and vendor-directed remediation.

Executive priority

Treat as a focused but important remediation item for environments using ETINET BACKBOX. The vulnerability concerns authentication behavior, but available evidence lacks severity scoring and exploitation confirmation. Prioritize inventory, access restriction, and vendor-supported upgrade or hotfix validation.

Technical view

CVE-2021-33895 affects BACKBOX E4.09 22SEP2020 and H4.09 T0954V04^AAO. The USER_AUTHENTICATE_ procedure can return 0 for the User ID of the BBSV process when XYGate is not involved, leading BBSV to assume password authentication succeeded.

Likely exposure

Exposure appears limited to organizations operating ETINET BACKBOX virtual tape controller environments on the named E4.09 or H4.09 builds. The bundle does not identify broader affected products, CPEs, internet exposure patterns, or cloud-hosted variants.

Exploitation context

The provided sources do not state active exploitation, public exploit availability, or KEV listing. The issue is an authentication-control failure, so risk depends on access to the Backbox UI and knowledge or availability of relevant user identities.

Researcher notes

The public bundle gives useful root-cause detail but limited operational context. No CWE, CVSS vector, CPE list, exploit evidence, or complete fix matrix is provided. Analysis should remain constrained to the listed Backbox builds and vendor advisory language.

Mitigation direction

  • Inventory ETINET BACKBOX installations and record exact version procedure strings.
  • Apply ETINET or HPE guidance for affected E4.09 and H4.09 deployments.
  • For E4.10-16MAY2021, evaluate FIXPAK-19OCT-2022 availability.
  • Move to E4.11-19OCT2022 where appropriate per vendor resolution.
  • Restrict Backbox UI access to trusted administrative networks pending remediation.

Validation and detection

  • Confirm whether any BACKBOX deployment runs E4.09 22SEP2020 or H4.09 T0954V04^AAO.
  • Check vendor advisory applicability against installed version procedure identifiers.
  • Review administrative access paths to the Backbox UI.
  • Verify remediation by confirming updated fixed version or hotfix level.
  • Monitor authentication logs for unusual Backbox UI login activity.
Prepared
Confidence
medium
Sources
4

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

description · low confidence lookup

Credential and access behavior lookup

The CVE wording references authentication or credential exposure, so valid-account and credential-access review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2021-33895 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
0Timeline events
0ADP providers
3Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
n/an/an/aListed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.