DSA-2023-293: Security Update for Dell Networking MX Series Switches Vulnerabilities
Summary: Dell Networking MX Series Switches remediation is available for multiple security vulnerabilities that could be exploited by malicious users to compromise the affected system.
This article applies to
This article does not apply to
This article is not tied to any specific product.
Not all product versions are identified in this article.
Impact
Critical
Details
| Proprietary Code CVEs | Description | CVSS Base Score | CVSS Vector String |
|---|---|---|---|
| CVE-2023-28078 | Dell OS10 Networking Switches, versions 10.5.2.x and above, when configured with VLT or Smart Fabric mode contains an improper restriction of communication channel to intended endpoints vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability leading to information disclosure and a possible denial of service. This is a critical severity vulnerability as it allows an attacker to view sensitive data. Dell recommends customers to upgrade at the earliest opportunity. | 9.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H  |
| CVE-2023-32462 | Dell OS10 Networking Switches, versions 10.5.2.x and above, contain an OS command injection vulnerability when using remote user authentication. A remote unauthenticated attacker could potentially exploit this vulnerability, leading to the execution of arbitrary OS commands and possible system take over. This is a critical vulnerability as it allows an attacker to cause severe damage. Dell recommends customers to upgrade at the earliest opportunity. | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| Proprietary Code CVEs | Description | CVSS Base Score | CVSS Vector String |
|---|---|---|---|
| CVE-2023-28078 | Dell OS10 Networking Switches, versions 10.5.2.x and above, when configured with VLT or Smart Fabric mode contains an improper restriction of communication channel to intended endpoints vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability leading to information disclosure and a possible denial of service. This is a critical severity vulnerability as it allows an attacker to view sensitive data. Dell recommends customers to upgrade at the earliest opportunity. | 9.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H |
| CVE-2023-32462 | Dell OS10 Networking Switches, versions 10.5.2.x and above, contain an OS command injection vulnerability when using remote user authentication. A remote unauthenticated attacker could potentially exploit this vulnerability, leading to the execution of arbitrary OS commands and possible system take over. This is a critical vulnerability as it allows an attacker to cause severe damage. Dell recommends customers to upgrade at the earliest opportunity. | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Affected Products & Remediation
| Product | Software/Firmware | Affected Versions | Remediated Versions | Link |
|---|---|---|---|---|
| Dell EMC Networking MX5108n | Dell Networking MX SmartFabric OS10 | Versions prior to 10.5.4.9 | Version 10.5.4.9 or later | https://www.dell.com/support/home/product-support/product/poweredge-mx7000/drivers |
| Dell EMC Networking MX5108n | Dell Networking MX SmartFabric OS10 | Versions prior to 10.5.5.4 | Version 10.5.5.4 or later | https://www.dell.com/support/home/product-support/product/poweredge-mx7000/drivers |
| Dell EMC Networking MX9116n | Dell Networking MX SmartFabric OS10 | Versions prior to 10.5.4.9 | Version 10.5.4.9 or later | https://www.dell.com/support/home/product-support/product/poweredge-mx7000/drivers |
| Dell EMC Networking MX9116n | Dell Networking MX SmartFabric OS10 | Versions prior to 10.5.5.4 | 10.5.5.4 or later | https://www.dell.com/support/home/product-support/product/poweredge-mx7000/drivers |
| Product | Software/Firmware | Affected Versions | Remediated Versions | Link |
|---|---|---|---|---|
| Dell EMC Networking MX5108n | Dell Networking MX SmartFabric OS10 | Versions prior to 10.5.4.9 | Version 10.5.4.9 or later | https://www.dell.com/support/home/product-support/product/poweredge-mx7000/drivers |
| Dell EMC Networking MX5108n | Dell Networking MX SmartFabric OS10 | Versions prior to 10.5.5.4 | Version 10.5.5.4 or later | https://www.dell.com/support/home/product-support/product/poweredge-mx7000/drivers |
| Dell EMC Networking MX9116n | Dell Networking MX SmartFabric OS10 | Versions prior to 10.5.4.9 | Version 10.5.4.9 or later | https://www.dell.com/support/home/product-support/product/poweredge-mx7000/drivers |
| Dell EMC Networking MX9116n | Dell Networking MX SmartFabric OS10 | Versions prior to 10.5.5.4 | 10.5.5.4 or later | https://www.dell.com/support/home/product-support/product/poweredge-mx7000/drivers |
Revision History
| Revision | Date | Description |
|---|---|---|
| 1.0 | 2023-08-07 | Initial release |
Acknowledgements
CVE-2023-28078: Dell Technologies would like to thank Rafael Schaefer, ERNW Enno Rey Netzwerke GmbH for reporting this issue.
Related Information
Legal Disclaimer
Affected Products
Dell EMC Networking MX5108n, Dell EMC Networking MX9116nArticle Properties
Article Number: 000216530
Article Type: Dell Security Advisory
Last Modified: 08 Aug 2023
Find answers to your questions from other Dell users
Support Services
Check if your device is covered by Support Services.