PT-2024-12326 · Dell · Dell Os10 Networking Switches

Published 2024-02-15 · Updated 2024-02-19 · CVE-2023-32462

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Dell OS10 Networking Switches versions 10.5.2.x and above

Description A remote unauthenticated attacker could potentially exploit an OS command injection vulnerability when using remote user authentication, leading to the execution of arbitrary OS commands and possible system takeover. This is a critical issue as it allows an attacker to cause severe damage.

Recommendations For Dell OS10 Networking Switches versions 10.5.2.x and above, upgrade to a newer version at the earliest opportunity to resolve the issue. As a temporary workaround, consider restricting access to remote user authentication to minimize the risk of exploitation.

Fix

OS Command Injection

RCE

Weakness Enumeration

CWE-78

CWE-20

Related Identifiers

CVE-2023-32462

Affected Products

Dell Os10 Networking Switches

References · 15

• https://nvd.nist.gov/vuln/detail/CVE-2023-32462 · Security Note
• https://osv.dev/vulnerability/CVE-2023-32462 · Vendor Advisory
• https://dell.com/support/kbdoc/en-us/000216584/dsa-2023-124-security-update-for-dell-smartfabric-os10-multiple-vulnerabilities · Vendor Advisory
• https://twitter.com/the_yellow_fall/status/1759400116442788132 · Twitter Post
• https://twitter.com/Dinosn/status/1759424843076841648 · Twitter Post
• https://twitter.com/CVEnew/status/1758118103479693698 · Twitter Post
• https://t.me/pentestingnews/43795 · Telegram Post
• https://twitter.com/cracbot/status/1758370689042759814 · Twitter Post
• https://t.me/cvenotify/71523 · Telegram Post
• https://twitter.com/catnap707/status/1759410627595182151 · Twitter Post
• https://twitter.com/CCBalert/status/1759606465256423743 · Twitter Post
• https://twitter.com/CyberxtronTech/status/1759585814114357432 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1758156152410366190 · Twitter Post
• https://twitter.com/vuldb/status/1758152949577224477 · Twitter Post
• https://twitter.com/fridaysecurity/status/1759400368734187838 · Twitter Post