CVE-2024-45765

Dell Enterprise SONiC OS, version(s) 4.1.x, 4.2.x, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Command execution. This is a critical severity vulnerability as it allows high privilege OS commands to be executed with a less privileged role; so Dell recommends customers to upgrade at the earliest opportunity.

CVSS v3 9.1 CRITICAL

9.1^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 2.3 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://www.dell.com/support/kbdoc/en-us/000245655/dsa-2024-449-security-update-for-dell-enterprise-sonic-distribution-vulnerabilities	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:o:dell:enterprise_sonic_distribution::::::::
	cpe:2.3:o:dell:enterprise_sonic_distribution::::::::

History

No history.

Information

Published : 2024-11-08 16:15

Updated : 2024-11-13 19:06

NVD link : CVE-2024-45765

Mitre link : CVE-2024-45765

CVE.ORG link : CVE-2024-45765

JSON object : View

Products Affected

dell

enterprise_sonic_distribution

CWE

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

{"id": "CVE-2024-45765", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security_alert@emc.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 2.3}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.2}]}, "published": "2024-11-08T16:15:23.350", "references": [{"url": "https://www.dell.com/support/kbdoc/en-us/000245655/dsa-2024-449-security-update-for-dell-enterprise-sonic-distribution-vulnerabilities", "tags": ["Vendor Advisory"], "source": "security_alert@emc.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security_alert@emc.com", "description": [{"lang": "en", "value": "CWE-78"}]}], "descriptions": [{"lang": "en", "value": "Dell Enterprise SONiC OS, version(s) 4.1.x, 4.2.x, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Command execution. This is a critical severity vulnerability as it allows high privilege OS commands to be executed with a less privileged role; so Dell recommends customers to upgrade at the earliest opportunity."}, {"lang": "es", "value": "Dell Enterprise SONiC OS, versi\u00f3n(es) 4.1.x, 4.2.x, contiene(n) una vulnerabilidad de neutralizaci\u00f3n inadecuada de elementos especiales utilizados en un comando del sistema operativo ('inyecci\u00f3n de comando del sistema operativo'). Un atacante con privilegios elevados y acceso remoto podr\u00eda explotar esta vulnerabilidad, lo que provocar\u00eda la ejecuci\u00f3n del comando. Se trata de una vulnerabilidad de gravedad cr\u00edtica, ya que permite ejecutar comandos del sistema operativo con privilegios elevados con un rol menos privilegiado; por lo tanto, Dell recomienda a los clientes que actualicen la versi\u00f3n lo antes posible."}], "lastModified": "2024-11-13T19:06:45.377", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:dell:enterprise_sonic_distribution:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B562D424-8BFD-4EB8-B420-BBB9A9487BFD", "versionEndExcluding": "4.1.6", "versionStartIncluding": "4.1.0"}, {"criteria": "cpe:2.3:o:dell:enterprise_sonic_distribution:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "062610CC-696D-4014-AB7A-BA99EA7E0A24", "versionEndExcluding": "4.2.2", "versionStartIncluding": "4.2.0"}], "operator": "OR"}]}], "sourceIdentifier": "security_alert@emc.com"}