Security Resilience

CVE-2023-45084

Softiron Hypercloud 1.0 – 2.0.3

Published
05 December 2023
Modified
21 November 2024
CVSS Score v3.1 7.0
Click a component to see what it means
Raw vectorCVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:H
EPSS Score 0.0022 12th percentile
Risk Priority 48 floored blend · peak EPSS

CVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.

Summary

CVE-2023-45084 is a high-severity Missing Synchronization (CWE-820) vulnerability in Softiron Hypercloud. Its CVSS base score is 7.0 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Security Account Manager (T1003.002); ranked at the 12th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability Data

An issue exists in SoftIron HyperCloud where drive caddy removal and reinsertion without a reboot may erroneously cause the system to recognize the caddy as new media and wipe all data on the drives due to a missing synchronization flaw,…

more

which impacts data availability and integrity. This issue only impacts SoftIron HyperCloud "density" storage nodes running HyperCloud software versions 1.0 to before 2.0.3.

CWE(s)
CWE-820CWE-662

Related Threats

MITRE ATT&CK Enterprise Techniques

T1003.002 Security Account Manager Credential Access
Adversaries may attempt to extract credential material from the Security Account Manager (SAM) database either through in-memory techniques or through the Windows Registry where the SAM database is stored.
attack.mitre.org →
T1003.004 LSA Secrets Credential Access
Adversaries with SYSTEM access to a host may attempt to access Local Security Authority (LSA) secrets, which can contain a variety of different credential materials, such as credentials for service accounts.
attack.mitre.org →
T1011 Exfiltration Over Other Network Medium Exfiltration
Adversaries may attempt to exfiltrate data over a different network medium than the command and control channel.
attack.mitre.org →
T1014 Rootkit Stealth
Adversaries may use rootkits to hide the presence of programs, files, network connections, services, drivers, and other system components.
attack.mitre.org →
T1016.001 Internet Connection Discovery Discovery
Adversaries may check for Internet connectivity on compromised systems.
attack.mitre.org →
T1018 Remote System Discovery Discovery
Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system.
attack.mitre.org →
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2023-45085Same product: Softiron Hypercloud
CVE-2023-45083Same product: Softiron Hypercloud
CVE-2024-30387Shared CWE-662, CWE-820
CVE-2023-2801Shared CWE-662, CWE-820
CVE-2026-53277Shared CWE-662, CWE-820
CVE-2025-47999Shared CWE-820
CVE-2026-22163Shared CWE-820
CVE-2026-53153Shared CWE-820
CVE-2026-57029Shared CWE-820
CVE-2025-47154Shared CWE-820

Affected Assets

softiron
hypercloud
1.0 — 2.0.3

Mitigating Controls

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 partial match
blocks

Secure SDLC practices directly require proper concurrency controls and synchronization primitives during design and coding.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.5.14 Information transfer partial match
removes
A.5.15 Access control partial match
removes
A.5.16 Identity management partial match
removes
A.5.17 Authentication information partial match
removes
A.5.18 Access rights partial match
removes
A.8.10 Information deletion partial match
removes

Hardening callouts derived

DISA STIG baselines are authored against specific weaknesses. Where this CVE cites a broad weakness class, the mapping is not asserted at that abstraction (owner ruling, 2026-09-25: grade only at Base and below), so no rule is shown here rather than a rule shown against the wrong grain.

  • No fine-grained STIG row for CWE-662, a class-level weakness, and none of its children carries one either.

References