PT-2022-22154 · Dell · Cloudlink

Published 2022-09-01 · Updated 2022-09-07 · CVE-2022-34380

Positive Technologies (AI Summary)

CVSS v3.1

9.3

Critical

Base vector

AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Dell CloudLink versions prior to 7.1.3

Description The issue allows a high privileged local attacker to potentially bypass authentication and access the CloudLink system console, leading to a takeover of the system. This is due to an Authentication Bypass Using an Alternate Path or Channel vulnerability.

Recommendations For versions prior to 7.1.3, update to version 7.1.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the CloudLink system console to minimize the risk of exploitation.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2022-34380

Affected Products

Cloudlink

References · 4

• https://osv.dev/vulnerability/CVE-2022-34380 · Vendor Advisory
• https://dell.com/support/kbdoc/en-us/000202058/dsa-2022-210-dell-emc-cloudlink-security-update-for-multiple-security-vulnerabilities · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-34380 · Security Note
• https://t.me/cibsecurity/49176 · Telegram Post