PT-2021-21211 · Dell · Dell Enterprise Sonic Os

Published 2021-10-01 · Updated 2022-10-25 · CVE-2021-36309

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Dell Enterprise SONiC OS versions 3.3.0 and earlier

Description The issue allows an authenticated malicious user with access to the system to read sensitive information using the TACACSRadius credentials stored, potentially using it in further attacks.

Recommendations For versions 3.3.0 and earlier, consider restricting access to the TACACSRadius credentials to minimize the risk of exploitation. As a temporary workaround, limit the privileges of authenticated users to reduce the potential impact of sensitive information disclosure. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Insufficiently Protected Credentials

Weakness Enumeration

CWE-256

CWE-522

Related Identifiers

CVE-2021-36309

Affected Products

Dell Enterprise Sonic Os

References · 7

• https://dell.com/support/kbdoc/en-us/000191690/DSA-2021-190-Dell-Enterprise-SONiC-OS-Security-Update-for-an-information-disclosure-Vulnerability · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-36309 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-36309 · Security Note
• https://t.me/cvenotify/21794 · Telegram Post
• https://t.me/cvenotify/22158 · Telegram Post
• https://t.me/cibsecurity/29850 · Telegram Post
• https://t.me/cvenotify/21844 · Telegram Post