{"id":"CVE-2018-1466","aliases":["EUVD-2018-12045","GHSA-vf2v-x8qh-f73h"],"status":"published","title":"IBM SAN Volume Controller, IBM Storwize, IBM Spectrum Virtualize and IBM FlashSystem products (6...","description":"IBM SAN Volume Controller, IBM Storwize, IBM Spectrum Virtualize and IBM FlashSystem products (6.1, 6.2, 6.3, 6.4, 7.1, 7.2, 7.3, 7.4, 7.5, 7.6, 7.6.1, 7.7, 7.7.1, 7.8, 7.8.1, 8.1, and 8.1.1) use weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 140397.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.00809,"percentile":0.57119,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-326"],"published":"2018-05-17T21:00:00Z","modified":"2026-06-17T01:51:17Z","products":[{"vendor":"ibm","product":"flashsystem v9000"},{"vendor":"ibm","product":"san volume controller"},{"vendor":"ibm","product":"san_volume_controller_firmware"},{"vendor":"ibm","product":"spectrum virtualize for public cloud"},{"vendor":"ibm","product":"spectrum virtualize software"},{"vendor":"ibm","product":"spectrum_virtualize"},{"vendor":"ibm","product":"spectrum_virtualize_for_public_cloud"},{"vendor":"ibm","product":"storwize v3500"},{"vendor":"ibm","product":"storwize v3700"},{"vendor":"ibm","product":"storwize v5000"},{"vendor":"ibm","product":"storwize v7000 (2076)"},{"vendor":"ibm","product":"storwize_v3500_firmware"},{"vendor":"ibm","product":"storwize_v3700_firmware"},{"vendor":"ibm","product":"storwize_v5000_firmware"},{"vendor":"ibm","product":"storwize_v7000_firmware"},{"vendor":"ibm","product":"storwize_v9000_firmware"}],"references":[{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/140397","tags":["vdb-entry","x_refsource_XF","x_transferred","VDB Entry","Vendor Advisory"]},{"url":"http://www.ibm.com/support/docview.wss?uid=ssg1S1012282","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory"]},{"url":"http://www.securityfocus.com/bid/104349","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry"]},{"url":"http://www.ibm.com/support/docview.wss?uid=ssg1S1012263","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory"]},{"url":"http://www.ibm.com/support/docview.wss?uid=ssg1S1012283","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-1466"},{"url":"https://github.com/advisories/GHSA-vf2v-x8qh-f73h"}],"sources":{"cve":[{"id":"CVE-2018-1466","description":"IBM SAN Volume Controller, IBM Storwize, IBM Spectrum Virtualize and IBM FlashSystem products (6.1, 6.2, 6.3, 6.4, 7.1, 7.2, 7.3, 7.4, 7.5, 7.6, 7.6.1, 7.7, 7.7.1, 7.8, 7.8.1, 8.1, and 8.1.1) use weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 140397.","status":"published","published":"2018-05-17T21:00:00Z","modified":"2024-09-16T17:03:03.17Z","updated_at":"2026-11-02T14:35:09.139955Z"}],"euvd":[{"id":"EUVD-2018-12045","description":"IBM SAN Volume Controller, IBM Storwize, IBM Spectrum Virtualize and IBM FlashSystem products (6.1, 6.2, 6.3, 6.4, 7.1, 7.2, 7.3, 7.4, 7.5, 7.6, 7.6.1, 7.7, 7.7.1, 7.8, 7.8.1, 8.1, and 8.1.1) use weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 140397.","status":"published","published":"2018-05-17T21:00:00Z","modified":"2024-09-16T17:03:03Z","updated_at":"2026-11-03T00:55:45.787721Z"}],"ghsa":[{"id":"GHSA-vf2v-x8qh-f73h","title":"IBM SAN Volume Controller, IBM Storwize, IBM Spectrum Virtualize and IBM FlashSystem products (6...","description":"IBM SAN Volume Controller, IBM Storwize, IBM Spectrum Virtualize and IBM FlashSystem products (6.1, 6.2, 6.3, 6.4, 7.1, 7.2, 7.3, 7.4, 7.5, 7.6, 7.6.1, 7.7, 7.7.1, 7.8, 7.8.1, 8.1, and 8.1.1) use weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 140397.","status":"published","published":"2022-05-13T01:23:16Z","modified":"2023-02-01T05:07:19Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-326"],"updated_at":"2026-11-02T14:50:31.141675Z"}],"nvd":[{"id":"CVE-2018-1466","description":"IBM SAN Volume Controller, IBM Storwize, IBM Spectrum Virtualize and IBM FlashSystem products (6.1, 6.2, 6.3, 6.4, 7.1, 7.2, 7.3, 7.4, 7.5, 7.6, 7.6.1, 7.7, 7.7.1, 7.8, 7.8.1, 8.1, and 8.1.1) use weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 140397.","status":"published","published":"2018-05-17T21:29:00.713Z","modified":"2026-06-17T01:51:17.757Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":3.5,"vector":"AV:N/AC:M/Au:S/C:P/I:N/A:N","level":"low","assessor":"primary"}],"cwes":["CWE-326"],"updated_at":"2026-11-02T14:04:27.507872Z"}]}}