PT-2024-35716 · Dell · Dell Vxverify

Klaas Demter · Published 2024-12-11 · Updated 2024-12-16 · CVE-2024-53292

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Dell VxVerify versions prior to x.40.405

Description The issue concerns a Plain-text Password Storage Vulnerability in the shell wrapper of Dell VxVerify. A local high privileged attacker could potentially exploit this vulnerability, leading to the disclosure of certain user credentials. The attacker may be able to use the exposed credentials to access the vulnerable component with privileges of the compromised account.

Recommendations For versions prior to x.40.405, update to version x.40.405 or later to resolve the Plain-text Password Storage Vulnerability. As a temporary workaround, consider restricting access to the shell wrapper to minimize the risk of exploitation.

Fix

Insufficiently Protected Credentials

Weakness Enumeration

CWE-522

CWE-256

Related Identifiers

CVE-2024-53292

Affected Products

Dell Vxverify

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2024-53292 · Security Note
• https://dell.com/support/kbdoc/en-us/000258964/dsa-2024-492-security-update-dell-vxverify-on-vxrail-plaintext-password-storage-vulnerabilities · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-53292 · Vendor Advisory
• https://twitter.com/CVEnew/status/1866809431972835466 · Twitter Post
• https://t.me/cvenotify/103847 · Telegram Post
• https://twitter.com/cracbot/status/1868536595353329857 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1866763587949133826 · Twitter Post
• https://t.me/cvedetector/12618 · Telegram Post