Intel SSD DC S4500 and SSD DC S4600 series firmware before SCV10150 - improper authentication: Improper authentication

Impact

Improper authentication in the drive firmware lets an UNPRIVILEGED user with physical access escalate privilege on the drive, with full confidentiality, integrity and availability impact. These are mainstream datacenter SATA SSDs that shipped in enormous volume as boot and scratch media in ProLiant/PowerEdge/ThinkSystem-class nodes, which is exactly the tier of hardware that gets recycled into GPU builds and rented out bare-metal. BREAKS TENANT HANDOFF: authentication on the drive is the mechanism that is supposed to keep a departing tenant from reaching a reprovisioned drive's contents, and it is bypassable by someone with no privilege at all. The integrity impact matters as much as the read - an attacker who owns the drive controller can persist there through your reimage.

Who can reach it

An unprivileged attacker with physical access to the drive. No credentials of any kind required. Realistically: anyone in the hardware's physical path - decommission, RMA, colo, or a rack tech - and any second-hand S4500/S4600 you bought to fill out a build.

What to do

Flash to firmware SCV10150 or later; drive offline, node drained, vendor tooling (Intel MAS, or the OEM's own bundle - Lenovo shipped this as LEN-28116 and F5 issued its own bulletin, so if these drives came inside an OEM chassis check the OEM's firmware bundle rather than Intel's, because the OEM-qualified image is often the only one their controller will accept). This is a 2018 fix, so the operational question in 2026 is not whether a patch exists but whether anyone ever applied it to the second-hand S4500/S4600 inventory now sitting in your fleet - assume not, and audit. Any drive you cannot confirm was flashed and cannot account for the custody of should be treated as potentially firmware-implanted and destroyed rather than redeployed.

References