PT-2022-11588 · Unknown · Dcn S4600-10P-Si

Stefan Żaryn · Published 2022-04-05 · Updated 2022-07-12 · CVE-2021-42324

Positive Technologies (AI Summary)

CVSS v3.1

7.4

High

Base vector

AV:P/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions DCN S4600-10P-SI devices before R0241.0470

Description An issue was discovered due to improper parameter validation in the console interface, allowing a low-privileged authenticated attacker to escape the sandbox environment and execute system commands as root via shell metacharacters in the capture command parameters. Command output will be shown on the Serial interface of the device. Exploitation requires both credentials and physical access.

Recommendations For DCN S4600-10P-SI devices before R0241.0470, update to version R0241.0470 or later to resolve the issue. As a temporary workaround, consider restricting access to the console interface and limiting the use of the capture command to minimize the risk of exploitation.

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2021-42324

Affected Products

Dcn S4600-10P-Si

References · 4

• 🔥 https://exatel.pl/cve-2021-42324-metacharacter-injection-w-przelacznikach-dcn-s4600-10p-si · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-42324 · Security Note
• https://osv.dev/vulnerability/CVE-2021-42324 · Vendor Advisory
• https://dcneurope.eu/products/switches/s4600-10p-si · Note