PT-2024-8150 · Dell · Os10

Zzcentury · Published 2024-10-16 · Updated 2024-11-17 · CVE-2024-49560

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Dell SmartFabric OS10 Software versions 10.5.3.x through 10.5.6.x

Description: The issue is related to a command injection vulnerability. A low-privileged attacker with local access could potentially exploit this vulnerability, leading to command execution. The vulnerability is associated with the failure to sanitize input data at the management level, which could allow an attacker to execute arbitrary commands.

Recommendations: For versions 10.5.3.x through 10.5.6.x, consider disabling any functionality that allows command execution until a patch is available. Restrict local access to the system to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

BDU:2024-09691

CVE-2024-49560

Affected Products

Os10

References · 9

• https://dell.com/support/kbdoc/en-us/000247217/dsa-2024-425-security-update-for-dell-networking-os10-vulnerabilities · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-09691 · Security Note
• https://osv.dev/vulnerability/CVE-2024-49560 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-49560 · Security Note
• https://t.me/cvedetector/10575 · Telegram Post
• https://t.me/latest_high_impact_cve/1503 · Telegram Post
• https://twitter.com/cracbot/status/1858027348148498464 · Twitter Post
• https://twitter.com/CVEnew/status/1856180349732020724 · Twitter Post
• https://vuldb.com/?id.283968 · Note