"the customer mentioned that storage devices are being performed an authenticated scan by Nessus vulnerability tool and reporting this vulnerability. Please let us know what would be the workaround to fix this one"
DE2000H is an OEM of NetApp E-series product.
ThinkSystem Storage Manager EMW Version: 11.62.00.9009 Report Date: Thu Jun 30 07:09:20 UTC 2022
I have checked Netapp documents, I 'm not able to find the information about this vulnerabilities. I really appreciated if you could you please provide information for this questions?
the below KB mentioned that "SSH is not a supported management protocol for E-Series devices.". if the SSH is disabled by default,the product will not affected by this Vulnerability， is it correct？ Vulnerability:SSH Weak Key Exchange Algorithms Enabled
I am going to speak strictly about a NetApp non-OEM E-Series system. To confirm that the information below is still accurate for your Lenovo OEM system, please contact Lenovo Support.
For NetApp-branded E-Series systems, SSH is not needed for normal management operations, is only used by NetApp Support for troubleshooting purposes and is disabled by default for security.
The second KB you linked is the correct procedure for enabling and disabling SSH on a NetApp-branded E-Series system, but the process might be different on a Lenovo OEM system.
If your security scanner is reporting a vulnerability with your storage system's SSH, it is usually fine to disable SSH, but I strongly recommend that you contact Lenovo Support first to confirm that disabling SSH is truly the best option for you and your system.