BridgeHead FileStore versions prior to 24A (released in early 2024) expose the Apache Axis2 administration module on network-accessible endpoints with default c…

BridgeHead FileStore versions prior to 24A expose Apache Axis2 administration module with default credentials on network-accessible endpoints. Unauthenticated remote attackers can exploit this vulnerability to execute arbitrary OS commands by authenticating to the admin console with default credentials, uploading malicious Java archives as web services, and executing commands via SOAP requests to the deployed service.