PT-2024-27330 · Dell · Dell Powerprotect Dd

Published 2024-06-26 · Updated 2024-09-23 · CVE-2024-37140

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Dell PowerProtect DD versions prior to 8.0 Dell PowerProtect DD LTS 7.13.1.0 Dell PowerProtect DD LTS 7.10.1.30 Dell PowerProtect DD LTS 7.7.5.40

Description The issue is an OS command injection vulnerability in an admin operation. A remote low privileged attacker could potentially exploit this vulnerability, leading to the execution of arbitrary OS commands on the system application's underlying OS with the privileges of the vulnerable application. Exploitation may lead to a system take over by an attacker.

Recommendations For Dell PowerProtect DD versions prior to 8.0, update to version 8.0 or later. For Dell PowerProtect DD LTS 7.13.1.0, consider disabling admin operations until a patch is available. For Dell PowerProtect DD LTS 7.10.1.30, restrict access to the vulnerable admin operation to minimize the risk of exploitation. For Dell PowerProtect DD LTS 7.7.5.40, avoid using the vulnerable application until the issue is resolved.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2024-37140

Affected Products

Dell Powerprotect Dd

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2024-37140 · Security Note
• https://dell.com/support/kbdoc/en-us/000226148/dsa-2024-219-dell-technologies-powerprotect-dd-security-update-for-multiple-security-vulnerabilities · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-37140 · Vendor Advisory
• https://t.me/cvenotify/95748 · Telegram Post
• https://t.me/cvenotify/84449 · Telegram Post