CVE-2024-0005 is a Critical (CVSS 9.1) command injection flaw in Purity, the operating software for Pure Storage FlashArray and FlashBlade. The record says a malicious user could run arbitrary commands remotely through a specially crafted SNMP configuration. The record names no fixed version, so read the vendor security bulletin and upgrade Purity to the release it lists.
What's affected
- Product: Pure Storage Purity on FlashArray (Purity//FA) and FlashBlade (Purity//FB), per the CPE entries in the record.
- Affected and fixed Purity versions: the record does not list them, and I could not confirm them from the vendor bulletin. The vendor page I tried redirected twice to a different host, so I stopped there. Treat any version statement you read elsewhere as unconfirmed and check the Pure Storage product security bulletin for CVE-2024-0005.
- Severity: Critical, CVSS 9.1. The vector needs high privileges (PR:H) and has a changed scope (S:C), so the score reflects the damage after the SNMP configuration step, not an anonymous attack.
- Exploitation: the record's KEV flag is false. No advisory I read says it is exploited in the wild.
How to check if you're exposed
Start with your inventory. Find every FlashArray and FlashBlade you manage and record the Purity version from the management interface. Compare each version against the fixed releases in the vendor bulletin.
The record points at SNMP configuration, so also review it. List which SNMP settings are configured on each array, who changed them last, and which accounts hold administrative roles. Because the vector requires high privileges, the number of administrators is part of your exposure.
What to do now
- Identify all FlashArray and FlashBlade systems and their Purity versions.
- Open the Pure Storage security bulletin for CVE-2024-0005 and note the fixed Purity release for your branch.
- Schedule the upgrade through your normal storage change process, and ask the vendor if the matching release needs a support window.
- Review SNMP settings and administrator accounts. Remove accounts that no longer need administrative access.
- Keep management interfaces on a restricted network. This is general hardening, not a step the record prescribes.
Why it matters
The record maps this to CWE-77 (CWE-77), command injection. The weakness is that data from a configuration, here an SNMP setting, ends up in a command the system runs, without being neutralized first. Whoever controls that data controls part of the command.
A scope change in the score matters for storage. Code running on a storage controller can reach data and services well beyond one application. The high privilege requirement lowers the odds of a drive by attack, but a stolen or shared administrator login would be enough, so patch and tighten access together.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is CVE-2024-0005 exploited in the wild?
The record sets the KEV flag to false, and no advisory I read says it is exploited. That can change, so check the CISA Known Exploited Vulnerabilities catalog.
Do I need administrator access to exploit it?
The record vector says high privileges are required (PR:H), so it is not an anonymous attack. Limiting administrative accounts still reduces your exposure.
Sources
- Pure Storage product security page (listed in the record; it redirected, so I could not read the bulletin)
- Safeguard Gold entry for CVE-2024-0005
Last reviewed: 19 October 2026.
