PT-2024-8974 · Dell · Dell Enterprise Sonic Os

N3K

·

Published

2024-09-06

·

Updated

2024-11-13

·

CVE-2024-45763

CVSS v3.1

9.1

Critical

VectorAV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions: Dell Enterprise SONiC OS versions 4.1.x through 4.2.x
Description: The issue is related to an improper neutralization of special elements used in an OS command, which can be exploited by a high-privileged attacker with remote access to execute arbitrary commands. This is a critical severity issue that could lead to command execution and potentially allow a remote attacker to gain unauthorized access due to a weakness in the authentication process.
Recommendations: For Dell Enterprise SONiC OS versions 4.1.x through 4.2.x, upgrade to a newer version at the earliest opportunity to prevent remote attacks. As a temporary workaround, consider restricting access to vulnerable components until a patch is available. Avoid using vulnerable functions or parameters in affected API endpoints until the issue is resolved.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BDU:2024-10656
CVE-2024-45763

Affected Products

Dell Enterprise Sonic Os