PT-2022-19405 · Dell · Os10

Published 2022-09-28 · Updated 2022-09-30 · CVE-2022-29089

Positive Technologies (AI Summary)

CVSS v3.1

6.4

Medium

Base vector

AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H

Name of the Vulnerable Software and Affected Versions Dell Networking OS10 versions prior to October 2021

Description The issue allows a remote, unauthenticated attacker to potentially exploit it by reverse engineering to retrieve sensitive information and access the REST API with admin privileges.

Recommendations For versions prior to October 2021, consider disabling Smart Fabric Services until a fix is available. As a temporary workaround, restrict access to the REST API to minimize the risk of exploitation.

Fix

Insufficiently Protected Credentials

Weakness Enumeration

CWE-522

Related Identifiers

CVE-2022-29089

Affected Products

Os10

References · 4

• https://dell.com/support/kbdoc/en-us/000202971/dsa-2022-135-dell-emc-smartfabric-os10-security-update-for-multiple-security-vulnerabilities · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-29089 · Security Note
• https://osv.dev/vulnerability/CVE-2022-29089 · Vendor Advisory
• https://t.me/cibsecurity/50632 · Telegram Post