by Kastro
Paper/Archive/CVE-2023-28078

CVE-2023-28078

Dell Dell SmartFabric OS10 — Dell OS10 Networking Switches running 10.5.2.x and above contain a vulnerability with zeroMQ when VLT is configured.

EPSS 0.9%CVSS 9.1
critical.is priorityof 100
39
CVSS 9.1 (CNA, NVD agree)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 59.4.594 × 2011.9No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Dell OS10 Networking Switches running 10.5.2.x and above contain a vulnerability with zeroMQ when VLT is configured. A remote unauthenticated attacker could potentially exploit this vulnerability leading to information disclosure and a possible Denial of Service when a huge number of requests are sent to the switch. This is a high severity vulnerability as it allows an attacker to view sensitive data. Dell recommends customers to upgrade at the earliest opportunity.

Affected

ProductAffectedFixed inSource
Dell SmartFabric OS1010.5.5.0–CNA
Dell SmartFabric OS1010.5.5.3–CNA
Dell SmartFabric OS1010.5.5.1 (MX)–CNA
Dell SmartFabric OS1010.5.5.2 (MX)–CNA
Dell SmartFabric OS1010.5.4.x–CNA
Dell SmartFabric OS1010.5.4.6 (MX)–CNA
Dell SmartFabric OS1010.5.3.x–CNA
Dell SmartFabric OS1010.5.2.x–CNA
smartfabric_os1010.5.5.0–CISA-ADP
smartfabric_os1010.5.5.3–CISA-ADP
smartfabric_os1010.5.5.1\(mx\)–CISA-ADP
smartfabric_os1010.5.5.2\(mx\)–CISA-ADP

Scores by source

dell (CNA)9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

advisorydell.com/support/kbdoc/en-us/000216584/dsa-2023-124-security-update-for-dell-smartfabric-os10-multiple-vulnerabilities