PT-2023-26847 · Dell · Dell Os10 Networking Switches

CVE-2023-39248 · Publicado 2023-12-04 · Atualizado 2023-12-11

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Dell OS10 Networking Switches versions 10.5.2.x and above

Description The issue is related to an Uncontrolled Resource Consumption (Denial of Service) vulnerability. When switches are configured with VLT and VRRP, a remote unauthenticated user can cause the network to be flooded, leading to Denial of Service for actual network users. This allows an attacker to cause an outage of the network.

Recommendations For versions 10.5.2.x and above, upgrade to a newer version at the earliest opportunity to resolve the issue. As a temporary workaround, consider restricting the use of VLT and VRRP configurations to minimize the risk of exploitation.

Correção

Resource Exhaustion

Enumeração de Fraquezas

CWE-400

Identificadores relacionados

CVE-2023-39248

Produtos afetados

Dell Os10 Networking Switches

Referências · 6

• https://dell.com/support/kbdoc/en-us/000220138/dsa-2023-278-dell-networking-os10-security-updates-for-uncontrolled-resource-consumption · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2023-39248 · Aviso do Fabricante
• https://t.me/cvenotify/63155 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-39248 · Nota de Segurança
• https://t.me/cvenotify/62270 · Publicação no Telegram
• https://twitter.com/CVEnew/status/1731926290553520379 · Publicação no Twitter