PT-2023-26847 · Dell · Dell Os10 Networking Switches

Published 2023-12-04 · Updated 2023-12-11 · CVE-2023-39248

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Dell OS10 Networking Switches versions 10.5.2.x and above

Description The issue is related to an Uncontrolled Resource Consumption (Denial of Service) vulnerability. When switches are configured with VLT and VRRP, a remote unauthenticated user can cause the network to be flooded, leading to Denial of Service for actual network users. This allows an attacker to cause an outage of the network.

Recommendations For versions 10.5.2.x and above, upgrade to a newer version at the earliest opportunity to resolve the issue. As a temporary workaround, consider restricting the use of VLT and VRRP configurations to minimize the risk of exploitation.

Fix

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

CVE-2023-39248

Affected Products

Dell Os10 Networking Switches

References · 6

• https://dell.com/support/kbdoc/en-us/000220138/dsa-2023-278-dell-networking-os10-security-updates-for-uncontrolled-resource-consumption · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-39248 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-39248 · Security Note
• https://t.me/cvenotify/63155 · Telegram Post
• https://t.me/cvenotify/62270 · Telegram Post
• https://twitter.com/CVEnew/status/1731926290553520379 · Twitter Post