DSA-2025-275: Security Update for Dell Enterprise SONiC Distribution Vulnerabilities

Sommaire: Dell Enterprise SONiC remediation is available for multiple security vulnerabilities that could be exploited by malicious users to compromise the affected system.

Cet article s’applique à Cet article ne s’applique pas à Cet article n’est lié à aucun produit spécifique. Toutes les versions de produits ne sont pas identifiées dans cet article.
Consulter d’autres ressources

Impact

High

Détails

Third-party Component CVEs More Information
libtasn1-6 CVE-2024-12133 https://nvd.nist.gov/vuln/searchThis hyperlink is taking you to a website outside of Dell Technologies.
gnutls28 CVE-2024-12243 https://nvd.nist.gov/vuln/searchThis hyperlink is taking you to a website outside of Dell Technologies.
libxml2 CVE-2022-49043, CVE-2023-39615, CVE-2023-45322, CVE-2024-25062, CVE-2024-56171, CVE-2025-24928, CVE-2025-27113 https://nvd.nist.gov/vuln/searchThis hyperlink is taking you to a website outside of Dell Technologies.
krb5 CVE-2025-24528 https://nvd.nist.gov/vuln/searchThis hyperlink is taking you to a website outside of Dell Technologies.
radius CVE-2024-3596 https://nvd.nist.gov/vuln/searchThis hyperlink is taking you to a website outside of Dell Technologies.

 

Proprietary Code CVEs Description CVSS Base Score CVSS Vector String
CVE-2025-38741 Dell Enterprise SONiC OS, version 4.5.0, contains a cryptographic key vulnerability in SSH. An unauthenticated remote attacker could potentially exploit this vulnerability, leading to unauthorized access to communication. 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NThis hyperlink is taking you to a website outside of Dell Technologies.

 

Proprietary Code CVEs Description CVSS Base Score CVSS Vector String
CVE-2025-38741 Dell Enterprise SONiC OS, version 4.5.0, contains a cryptographic key vulnerability in SSH. An unauthenticated remote attacker could potentially exploit this vulnerability, leading to unauthorized access to communication. 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NThis hyperlink is taking you to a website outside of Dell Technologies.

 

Dell Technologies recommande à tous ses clients de tenir compte à la fois du score de base CVSS et de tous les scores temporels et environnementaux pertinents qui pourraient avoir une incidence sur la gravité potentielle associée à une vulnérabilité de sécurité particulière.

Produits touchés et correction

CVEs Addressed Product Affected Versions Remediated Versions Link
CVE-2024-12133, CVE-2024-12243, CVE-2022-49043, CVE-2023-39615, CVE-2023-45322, CVE-2024-25062, CVE-2024-56171, CVE-2025-24928, CVE-2025-27113, CVE-2025-24528, CVE-2024-3596 Dell Enterprise SONiC Distribution Versions prior to 4.5.0 Version 4.5.0 Link to update
CVE-2025-38741 Dell Enterprise SONiC Distribution Version 4.5.0 Version 4.5.0a Link to update

 

CVEs Addressed Product Affected Versions Remediated Versions Link
CVE-2024-12133, CVE-2024-12243, CVE-2022-49043, CVE-2023-39615, CVE-2023-45322, CVE-2024-25062, CVE-2024-56171, CVE-2025-24928, CVE-2025-27113, CVE-2025-24528, CVE-2024-3596 Dell Enterprise SONiC Distribution Versions prior to 4.5.0 Version 4.5.0 Link to update
CVE-2025-38741 Dell Enterprise SONiC Distribution Version 4.5.0 Version 4.5.0a Link to update

 

Solutions de contournement et mesures d’atténuation

CVE ID Workaround and Mitigation
CVE-2025-38741

To fully remediate CVE-2025-38741, please follow either one of the steps below. 

  1. Users that have installed 4.5.0 and will remain on 4.5.0 must run the CLI commands below to regenerate new key pairs for the SSH server.
  2. Users may also upgrade to 4.5.0a for full remediation without being required to run the CLI commands below.

sonic# crypto ssh-keygen ecdsa 256

sonic# crypto ssh-keygen rsa 2048

 

 

 

Historique de révision

RevisionDateDescription
1.02025-07-02Initial Release
2.02025-08-01Updated to include CVE-2025-38741

 

Renseignements connexes

Dell Security Advisories and Notices
Dell Vulnerability Response Policy
CVSS Scoring Guide

Avis de non-responsabilité

Produits touchés

Enterprise SONiC Distribution, PowerSwitch E3200-ON Series, Dell EMC Networking N3200-ON, PowerSwitch S3248T-ON, PowerSwitch S4348F/S4348T-ON, PowerSwitch S5212F-ON, PowerSwitch S5224F-ON, PowerSwitch S5232F-ON, PowerSwitch S5248F-ON , PowerSwitch S5296F-ON, PowerSwitch S5448F-ON, PowerSwitch Z9264F-ON, PowerSwitch Z9332F-ON, PowerSwitch Z9432F-ON, PowerSwitch Z9864F-ON ...
Propriétés de l’article
Numéro d’article: 000340083
Type d’article: Dell Security Advisory
Dernière modification: 01 août 2025
Obtenez des réponses à vos questions auprès d’autre utilisateurs de Dell
Services de soutien
Vérifiez si votre appareil est couvert par les services de soutien.