PT-2024-19415 · Dell · Dell Recoverpoint For Virtual Machines

Published 2024-02-16 · Updated 2024-08-29 · CVE-2024-22426

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Dell RecoverPoint for Virtual Machines versions 5.3.x Dell RecoverPoint for Virtual Machines version 6.0.SP1

Description The issue is an OS Command injection vulnerability that could be exploited by an unauthenticated remote attacker to execute arbitrary operating system commands in the context of the root user, resulting in a complete system compromise.

Recommendations For version 5.3.x, update to a version that contains a fix for this issue. For version 6.0.SP1, update to a version that contains a fix for this issue. As a temporary workaround, consider restricting access to the system to minimize the risk of exploitation.

Fix

Unrestricted File Upload

OS Command Injection

Weakness Enumeration

CWE-434

CWE-78

Related Identifiers

CVE-2024-22426

Affected Products

Dell Recoverpoint For Virtual Machines

References · 8

• https://dell.com/support/kbdoc/en-us/000222133/dsa-2024-092-security-update-for-dell-recoverpoint-for-virtual-machines-multiple-vulnerabilities · Vendor Advisory
• https://dell.com/support/kbdoc/en-us/000228154/dsa-2024-369-security-update-for-dell-recoverpoint-for-virtual-machines-multiple-vulnerabilities · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-22426 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-22426 · Security Note
• https://twitter.com/cracbot/status/1758733052677890129 · Twitter Post
• https://t.me/cvenotify/92649 · Telegram Post
• https://t.me/cvenotify/71704 · Telegram Post
• https://twitter.com/CVEnew/status/1758455738748354783 · Twitter Post