DSA-2023-124: Security Update for Dell SmartFabric OS10 Multiple Vulnerabilities.
Summary: Dell SmartFabric OS10 remediation is available for multiple security vulnerabilities that could be exploited by malicious users to compromise the affected system.
This article applies to
This article does not apply to
This article is not tied to any specific product.
Not all product versions are identified in this article.
Impact
Critical
Details
| Proprietary Code CVEs | Description | CVSS Base Score | CVSS Vector String |
|---|---|---|---|
| CVE-2023-28078 | Dell OS10 Networking Switches running 10.5.2.x and above contain a vulnerability with zeroMQ when VLT is configured. A remote unauthenticated attacker could potentially exploit this vulnerability leading to information disclosure and a possible Denial of Service when a huge number of requests are sent to the switch. This is a high severity vulnerability as it allows an attacker to view sensitive data. Dell recommends customers to upgrade at the earliest opportunity. | 9.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H |
| CVE-2023-32462 | Dell OS10 Networking Switches running 10.5.2.x and above contain an OS command injection vulnerability when using remote user authentication. A remote unauthenticated attacker could potentially exploit this vulnerability, leading to the execution of arbitrary OS commands and possible system takeover. This is a critical vulnerability as it allows an attacker to cause severe damage. Dell recommends customers to upgrade at the earliest opportunity. | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| Proprietary Code CVEs | Description | CVSS Base Score | CVSS Vector String |
|---|---|---|---|
| CVE-2023-28078 | Dell OS10 Networking Switches running 10.5.2.x and above contain a vulnerability with zeroMQ when VLT is configured. A remote unauthenticated attacker could potentially exploit this vulnerability leading to information disclosure and a possible Denial of Service when a huge number of requests are sent to the switch. This is a high severity vulnerability as it allows an attacker to view sensitive data. Dell recommends customers to upgrade at the earliest opportunity. | 9.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H |
| CVE-2023-32462 | Dell OS10 Networking Switches running 10.5.2.x and above contain an OS command injection vulnerability when using remote user authentication. A remote unauthenticated attacker could potentially exploit this vulnerability, leading to the execution of arbitrary OS commands and possible system takeover. This is a critical vulnerability as it allows an attacker to cause severe damage. Dell recommends customers to upgrade at the earliest opportunity. | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Affected Products & Remediation
| CVEs Addressed | Product | Affected Versions | Remediated Versions | Link |
|---|---|---|---|---|
| CVE-2023-28078, CVE-2023-32462 |
Dell SmartFabric OS10 | 10.5.5.0, 10.5.5.3 | 10.5.5.5 | https://www.dell.com/support |
| CVE-2023-28078, CVE-2023-32462 |
Dell SmartFabric OS10 | 10.5.5.1 (MX), 10.5.5.2 (MX) |
10.5.5.4 (MX) | DSA-2023-293: Security Update for Dell Networking MX Series Switches Vulnerabilities |
| CVE-2023-28078, CVE-2023-32462 |
Dell SmartFabric OS10 | 10.5.4.x | 10.5.4.8 | https://www.dell.com/support |
| CVE-2023-28078, CVE-2023-32462 |
Dell SmartFabric OS10 | 10.5.4.6 (MX) | 10.5.4.9 (MX) | DSA-2023-293: Security Update for Dell Networking MX Series Switches Vulnerabilities |
| CVE-2023-28078, CVE-2023-32462 |
Dell SmartFabric OS10 | 10.5.3.x | 10.5.3.8 | https://www.dell.com/support |
| CVE-2023-28078, CVE-2023-32462 |
Dell SmartFabric OS10 | 10.5.2.x | 10.5.2.12 | https://www.dell.com/support |
| CVEs Addressed | Product | Affected Versions | Remediated Versions | Link |
|---|---|---|---|---|
| CVE-2023-28078, CVE-2023-32462 |
Dell SmartFabric OS10 | 10.5.5.0, 10.5.5.3 | 10.5.5.5 | https://www.dell.com/support |
| CVE-2023-28078, CVE-2023-32462 |
Dell SmartFabric OS10 | 10.5.5.1 (MX), 10.5.5.2 (MX) |
10.5.5.4 (MX) | DSA-2023-293: Security Update for Dell Networking MX Series Switches Vulnerabilities |
| CVE-2023-28078, CVE-2023-32462 |
Dell SmartFabric OS10 | 10.5.4.x | 10.5.4.8 | https://www.dell.com/support |
| CVE-2023-28078, CVE-2023-32462 |
Dell SmartFabric OS10 | 10.5.4.6 (MX) | 10.5.4.9 (MX) | DSA-2023-293: Security Update for Dell Networking MX Series Switches Vulnerabilities |
| CVE-2023-28078, CVE-2023-32462 |
Dell SmartFabric OS10 | 10.5.3.x | 10.5.3.8 | https://www.dell.com/support |
| CVE-2023-28078, CVE-2023-32462 |
Dell SmartFabric OS10 | 10.5.2.x | 10.5.2.12 | https://www.dell.com/support |
Workarounds & Mitigations
None.
Revision History
| Revision | Date | Description |
|---|---|---|
| 1.0 | 2023-08-08 | Initial Release |
| 2.0 | 2023-08-08 | Updated for enhanced presentation with no changes to content. |
| 3.0 | 2023-08-09 | Major Revision: revised support links for MX versions and acknowledgements added. |
Acknowledgements
CVE-2023-28078: Dell Technologies would like to thank Rafael Schaefer, ERNW Enno Rey Netzwerke GmbH for reporting this issue.
Related Information
Legal Disclaimer
Article Properties
Article Number: 000216584
Article Type: Dell Security Advisory
Last Modified: 09 Aug 2023
Find answers to your questions from other Dell users
Support Services
Check if your device is covered by Support Services.