PT-2023-30888 · Dell · Dell Powerprotect Dd

Published 2023-12-14 · Updated 2023-12-27 · CVE-2023-48667

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Dell PowerProtect DD versions prior to 7.13.0.10 Dell PowerProtect DD LTS versions prior to 7.7.5.25 Dell PowerProtect DD LTS versions prior to 7.10.1.15 Dell PowerProtect DD version 6.2.1.110

Description The issue is an OS command injection vulnerability in the administrator CLI. A remote high privileged attacker could potentially exploit this vulnerability, leading to the execution of arbitrary OS commands on the application's underlying OS to bypass security restrictions. Exploitation may lead to a system takeover by an attacker.

Recommendations For versions prior to 7.13.0.10, update to version 7.13.0.10 or later. For LTS versions prior to 7.7.5.25, update to version 7.7.5.25 or later. For LTS versions prior to 7.10.1.15, update to version 7.10.1.15 or later. For version 6.2.1.110, update to a version later than 6.2.1.110. As a temporary workaround, consider restricting access to the administrator CLI until a patch is available.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2023-48667

Affected Products

Dell Powerprotect Dd

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2023-48667 · Security Note
• https://osv.dev/vulnerability/CVE-2023-48667 · Vendor Advisory
• https://dell.com/support/kbdoc/en-us/000220264/dsa-2023-412-dell-technologies-powerprotect-security-update-for-multiple-security-vulnerabilities · Vendor Advisory
• https://twitter.com/CVEnew/status/1735326971389743331 · Twitter Post
• https://t.me/cvenotify/65263 · Telegram Post