PT-2024-9594 · Dell · Dell Emc Recoverpoint For Vms

Published 2024-12-13 · Updated 2024-12-14 · CVE-2024-28980

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Dell RecoverPoint for VMs versions 6.0.x

Description The issue is related to the use of a broken or risky cryptographic algorithm in the SSH component. An unauthenticated attacker with remote access could potentially exploit this, leading to remote execution.

Recommendations For version 6.0.x, consider disabling the SSH functionality until a patch is available to mitigate the risk of exploitation. Restrict access to the SSH component to minimize the risk of remote execution.

Fix

Use of a Broken Cryptographic Algorithm

Weakness Enumeration

CWE-327

Related Identifiers

BDU:2024-11303

CVE-2024-28980

Affected Products

Dell Emc Recoverpoint For Vms

References · 5

• https://dell.com/support/kbdoc/en-us/000259765/dsa-2024-429-security-update-for-dell-recoverpoint-for-virtual-machines-multiple-third-party-component-vulnerabilities · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-28980 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-11303 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-28980 · Security Note
• https://twitter.com/CVEnew/status/1868033921210003808 · Twitter Post