PT-2024-22781 · Dell · Dell Powerprotect Data Domain

Published 2024-06-26 · Updated 2024-09-23 · CVE-2024-29175

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Dell PowerProtect Data Domain versions prior to 7.13.0.0 Dell PowerProtect Data Domain LTS 7.7.5.40 Dell PowerProtect Data Domain LTS 7.10.1.30

Description The issue is related to a weak cryptographic algorithm. A remote unauthenticated attacker could potentially exploit this, leading to a man-in-the-middle attack that exposes sensitive session information.

Recommendations For versions prior to 7.13.0.0, update to version 7.13.0.0 or later. For LTS 7.7.5.40, update to a version later than 7.7.5.40. For LTS 7.10.1.30, update to a version later than 7.10.1.30.

Fix

Use of a Broken Cryptographic Algorithm

Weakness Enumeration

CWE-327

Related Identifiers

CVE-2024-29175

Affected Products

Dell Powerprotect Data Domain

References · 5

• https://dell.com/support/kbdoc/en-us/000226148/dsa-2024-219-dell-technologies-powerprotect-dd-security-update-for-multiple-security-vulnerabilities · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-29175 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-29175 · Security Note
• https://t.me/cvenotify/84440 · Telegram Post
• https://t.me/cvenotify/95752 · Telegram Post