DSA-2024-425: Security Update for Dell Networking OS10 Vulnerabilities
요약: Dell Networking OS10 remediation is available for multiple security vulnerabilities that could be exploited by malicious users to compromise the affected system.
이 문서는 다음에 적용됩니다.
이 문서는 다음에 적용되지 않습니다.
이 문서는 특정 제품과 관련이 없습니다.
모든 제품 버전이 이 문서에 나와 있는 것은 아닙니다.
영향
High
세부 정보
| Proprietary Code CVEs |
Description |
CVSS Base Score |
CVSS Vector String |
| CVE-2024-48837 |
Dell SmartFabric OS10 Software, version(s) 10.5.6.x, 10.5.5.x, 10.5.4.x, 10.5.3.x, contain(s) an Execution with Unnecessary Privileges vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Command execution.
|
7.8 |
|
| CVE-2024-48838 |
Dell SmartFabric OS10 Software, version(s) 10.5.6.x, 10.5.5.x, 10.5.4.x, 10.5.3.x, contain(s) a Files or Directories Accessible to External Parties vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Filesystem access for attacker.
|
3.3 |
|
| CVE-2024-49557 |
Dell SmartFabric OS10 Software, version(s) 10.5.6.x, 10.5.5.x, 10.5.4.x, 10.5.3.x, contain(s) an Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Code execution.
|
7.8 |
|
| CVE-2024-49558 |
Dell SmartFabric OS10 Software, version(s) 10.5.6.x, 10.5.5.x, 10.5.4.x, 10.5.3.x, contain(s) an Improper Privilege Management vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of privileges.
|
7.8 |
|
| CVE-2024-49560 |
Dell SmartFabric OS10 Software, version(s) 10.5.6.x, 10.5.5.x, 10.5.4.x, 10.5.3.x, contain(s) a command injection vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Command execution. |
7.8 |
| Proprietary Code CVEs |
Description |
CVSS Base Score |
CVSS Vector String |
| CVE-2024-48837 |
Dell SmartFabric OS10 Software, version(s) 10.5.6.x, 10.5.5.x, 10.5.4.x, 10.5.3.x, contain(s) an Execution with Unnecessary Privileges vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Command execution.
|
7.8 |
|
| CVE-2024-48838 |
Dell SmartFabric OS10 Software, version(s) 10.5.6.x, 10.5.5.x, 10.5.4.x, 10.5.3.x, contain(s) a Files or Directories Accessible to External Parties vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Filesystem access for attacker.
|
3.3 |
|
| CVE-2024-49557 |
Dell SmartFabric OS10 Software, version(s) 10.5.6.x, 10.5.5.x, 10.5.4.x, 10.5.3.x, contain(s) an Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Code execution.
|
7.8 |
|
| CVE-2024-49558 |
Dell SmartFabric OS10 Software, version(s) 10.5.6.x, 10.5.5.x, 10.5.4.x, 10.5.3.x, contain(s) an Improper Privilege Management vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of privileges.
|
7.8 |
|
| CVE-2024-49560 |
Dell SmartFabric OS10 Software, version(s) 10.5.6.x, 10.5.5.x, 10.5.4.x, 10.5.3.x, contain(s) a command injection vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Command execution. |
7.8 |
영향을 받는 제품 및 문제 해결
| Product |
Affected Versions |
Remediated Versions |
Link |
| Dell Networking OS10 |
Version 10.5.6.x |
Version 10.5.6.6 |
|
| Dell Networking OS10 |
Version 10.5.5.x |
Version 10.5.5.12 |
|
| Dell Networking OS10 |
Version 10.5.4.x |
Version 10.5.4.13 |
| Product |
Affected Versions |
Remediated Versions |
Link |
| Dell Networking OS10 |
Version 10.5.6.x |
Version 10.5.6.6 |
|
| Dell Networking OS10 |
Version 10.5.5.x |
Version 10.5.5.12 |
|
| Dell Networking OS10 |
Version 10.5.4.x |
Version 10.5.4.13 |
- SmartFabric OS10 downloads are also available from your Dell Digital Locker.
- The Affected Products and Remediation table above may not be a comprehensive list of all affected supported versions and may be updated as more information becomes available.
Note: If version 10.5.3.x is being used, the remediation requires upgrading to a newer major release.
개정 내역
|
Revision |
Date |
Description |
|
1.0 |
2024-11-11 |
Initial Release |
|
2.0 |
2024-11-22 |
Formatting changes only. No changes to content. |
감사의 말
- CVE-2024-48837, CVE-2024-48838, CVE-2024-49557, CVE-2024-49558: Dell would like to thank n3k From TIANGONG Team of Legendsec at QI-ANXIN Group for reporting these issues.
- CVE-2024-49560: Dell would like to thank zzcentury from Ubisectech Sirius Team for reporting this issue.
관련 정보
법적 고지 사항
해당 제품
SmartFabric OS10 Software문서 속성
문서 번호: 000247217
문서 유형: Dell Security Advisory
마지막 수정 시간: 22 11월 2024
다른 Dell 사용자에게 질문에 대한 답변 찾기
지원 서비스
디바이스에 지원 서비스가 적용되는지 확인하십시오.