CVE-2024-49557
Improper Neutralization of Special Elements used in a Command ('Command Injection') (CWE-77)
Summary
Dell SmartFabric OS10 Software, versions 10.5.6.x, 10.5.5.x, 10.5.4.x, and 10.5.3.x, contain an Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability. This vulnerability allows a low-privileged attacker with local access to potentially execute code on the affected system.
Impact
If exploited, this vulnerability could lead to code execution on the affected Dell SmartFabric OS10 systems. The attacker could potentially gain unauthorized access, execute arbitrary commands, or elevate privileges. Given the CVSS v3.1 base score of 7.8 (High severity) and the impact ratings of High for Confidentiality, Integrity, and Availability, this vulnerability could significantly compromise the security of affected systems.
Exploitation
There is no evidence that a public proof-of-concept exists. There is no evidence of proof of exploitation at the moment.
Patch
A patch is available. Dell has released a security update to address this vulnerability, which can be found in the Dell Security Advisory (DSA-2024-425) at https://www.dell.com/support/kbdoc/en-us/000247217/dsa-2024-425-security-update-for-dell-networking-os10-vulnerabilities
Mitigation
1. Apply the security update provided by Dell as soon as possible. 2. Limit local access to the affected systems to only trusted users. 3. Monitor systems for any suspicious activities or unauthorized access attempts. 4. Implement the principle of least privilege to minimize the potential impact of the vulnerability. 5. Consider network segmentation to isolate affected systems until patching is complete. 6. Regularly review and update access controls on affected systems.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Timeline
Feedly found the first article mentioning CVE-2024-49557. See article
Feedly estimated the CVSS score as HIGH
NVD published the first details for CVE-2024-49557
A CVSS base score of 7.8 has been assigned.
EPSS Score was set to: 0.04% (Percentile: 10.1%)