PT-2023-9118 · Dell · Dell Powerprotect Data Manager Dm5500

Published 2023-12-04 · Updated 2023-12-18 · CVE-2023-44291

Positive Technologies (AI Summary)

CVSS v2.0

8.3

High

Base vector

AV:N/AC:L/Au:M/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Dell PowerProtect Data Manager DM5500 version 5.14.0.0

Description The issue exists due to the lack of neutralization of special elements used in an operating system command. A remote attacker with high privileges could potentially exploit this vulnerability, leading to the execution of arbitrary OS commands on the underlying OS, with the privileges of the vulnerable application. Exploitation may lead to a system takeover by an attacker.

Recommendations For version 5.14.0.0, consider disabling the PPOE component as a temporary workaround until a patch is available. Restrict access to the vulnerable application to minimize the risk of exploitation. Avoid using the vulnerable component until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BDU:2024-03921

CVE-2023-44291

Affected Products

Dell Powerprotect Data Manager Dm5500

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2023-44291 · Security Note
• https://dell.com/support/kbdoc/en-us/000220107/dsa-2023-425-security-update-for-dell-powerprotect-data-manager-dm5500-appliance-for-multiple-vulnerabilities · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-03921 · Security Note
• https://osv.dev/vulnerability/CVE-2023-44291 · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/1731642352287039876 · Twitter Post
• https://twitter.com/CVEnew/status/1731594022312120436 · Twitter Post
• https://twitter.com/cracbot/status/1732111512024571979 · Twitter Post
• https://t.me/cvenotify/62077 · Telegram Post