PT-2023-6716 · Dell · Dell Command | Intel Vpro Out Of Band

Ycdxsb · Published 2023-02-08 · Updated 2023-02-23 · CVE-2023-23697

Positive Technologies (AI Summary)

CVSS v3.1

4.7

Medium

Base vector

AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Dell Command | Intel vPro Out of Band versions before 4.4.0

Description The issue is related to an arbitrary folder delete vulnerability during uninstallation. A locally authenticated malicious user may potentially exploit this vulnerability, leading to arbitrary folder deletion. The vulnerability is also associated with incorrect link resolution before file access, which could allow an attacker to delete an arbitrary folder.

Recommendations For versions before 4.4.0, update to version 4.4.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the uninstallation process to minimize the risk of exploitation.

Fix

Insecure Operation on Windows Junction

Link Following

Weakness Enumeration

CWE-1386

CWE-59

Related Identifiers

BDU:2023-07489

CVE-2023-23697

Affected Products

Dell Command | Intel Vpro Out Of Band

References · 7

• https://osv.dev/vulnerability/CVE-2023-23697 · Vendor Advisory
• https://dell.com/support/kbdoc/en-us/000207929/dsa-2023-030 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-23697 · Security Note
• https://bdu.fstec.ru/vul/2023-07489 · Security Note
• https://t.me/cvenotify/44217 · Telegram Post
• https://t.me/cvenotify/44222 · Telegram Post
• https://vuldb.com/?id.220764 · Note