PT-2020-18421 · Dell Emc · Dell Emc Integrated Data Protection Appliance

Published 2020-04-15 · Updated 2020-04-23 · CVE-2020-5350

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Dell EMC Integrated Data Protection Appliance versions 2.0 through 2.4

Description The issue concerns a command injection vulnerability in the ACM component. A remote authenticated malicious user with root privileges could inject parameters in the ACM component APIs, potentially leading to manipulation of passwords and execution of malicious commands on the ACM component.

Recommendations For versions 2.0 through 2.4, consider restricting access to the ACM component APIs to prevent parameter injection until a patch is available. As a temporary workaround, limit the privileges of remote authenticated users to minimize the risk of exploitation. Avoid using the ACM component until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2020-5350

Affected Products

Dell Emc Integrated Data Protection Appliance

References · 4

• https://dell.com/support/security/en-us/details/542518/DSA-2020-079-Dell-EMC-Integrated-Data-Protection-Appliance-Command-Injection-Vulnerability · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-5350 · Security Note
• https://osv.dev/vulnerability/CVE-2020-5350 · Vendor Advisory
• https://t.me/cvenotify/2814 · Telegram Post