PT-2024-31758 · Dell · Dell Enterprise Sonic Os

N3K · Published 2024-11-08 · Updated 2024-11-13 · CVE-2024-45765

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Dell Enterprise SONiC OS versions 4.1.x through 4.2.x

Description: The issue is related to an Improper Neutralization of Special Elements used in an OS Command, also known as 'OS Command Injection'. This allows a high privileged attacker with remote access to potentially execute commands. The severity of this issue is critical, as it enables the execution of high privilege OS commands with a less privileged role.

Recommendations: For Dell Enterprise SONiC OS versions 4.1.x through 4.2.x, upgrade at the earliest opportunity to resolve the issue. As a temporary workaround, consider restricting access to sensitive areas of the system to minimize the risk of exploitation.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2024-45765

Affected Products

Dell Enterprise Sonic Os

References · 11

• https://osv.dev/vulnerability/CVE-2024-45765 · Vendor Advisory
• https://dell.com/support/kbdoc/en-us/000245655/dsa-2024-449-security-update-for-dell-enterprise-sonic-distribution-vulnerabilities · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-45765 · Security Note
• https://t.me/cvedetector/10204 · Telegram Post
• https://twitter.com/CVEnew/status/1854922060390449600 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1855008378591818097 · Twitter Post
• https://twitter.com/CCBalert/status/1856398468366897268 · Twitter Post
• https://twitter.com/vulmoncom/status/1854981815553212877 · Twitter Post
• https://twitter.com/SecuriTricks/status/1856258622201778440 · Twitter Post
• https://twitter.com/the_yellow_fall/status/1856157474677764477 · Twitter Post
• https://twitter.com/CveFindCom/status/1854924769868595248 · Twitter Post