Back to Database
Status published
Medium
CVE-2024-13058
Authenticated, non-admin users can create storage pools via the sifi API
Vulnerability Description
An issue exists in SoftIron HyperCloud where authenticated, but non-admin users can create data pools, which could potentially impact the performance and availability of the backend software-defined storage subsystem. This issue only impacts SoftIron HyperCloud and related software products (such as VM Squared) software versions 2.3.0 to before 2.5.0.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-13058
Credits & Attribution
No credits recorded in the NVD database.
References
More from SoftIron
View All →CVE-2025-10650
Improper SSH Key Handling in Internal Debug Builds May Grant Cluster-Level Access to Non-Administrative Users
Low
1.8
CVE-2023-45085
When compute hosts are disabled and reenabled, they immediately transition to "ON", not "INIT"
Low
3.2
CVE-2023-45084
Media caddy removal and reinsertion without reboot may cause data loss
High
7
CVE-2023-45083
HyperCloud: "admin" and "serveradmin" users can be deleted
Medium
4.2
Affected Vendor
SoftIron
View all reports →Affected Software
HyperCloud
Vulnerable Versions:
2.3.0
Timeline
Official Publish:
December 30th, 2024
Last Modified:
August 29th, 2025
Added to House:
July 22nd, 2026
CVSS Vectors
MITRE ATT&CK TTPs
T1078
Valid Accounts
Persistence
T1098
Account Manipulation
Privilege Escalation
T1548
Abuse Elevation Control Mechanism
Privilege Escalation
T1222
File and Directory Permissions Modification
Defense Evasion
T1134
Access Token Manipulation
Defense Evasion
T1499
Endpoint Denial of Service
Impact
T1498
Network Denial of Service
Impact
T1190
Exploit Public-Facing Application
Initial Access
T1021
Remote Services
Lateral Movement