by Kastro
Paper/Archive/CVE-2023-32462

CVE-2023-32462

Dell Dell SmartFabric OS10 — Dell OS10 Networking Switches running 10.5.2.x and above contain an OS command injection vulnerability when using remote user authenticat…

EPSS 2%CVSS 9.8
critical.is priorityof 100
46
CVSS 9.8 (CNA, NVD agree)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 81.4.814 × 2016.3No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Dell OS10 Networking Switches running 10.5.2.x and above contain an OS command injection vulnerability when using remote user authentication. A remote unauthenticated attacker could potentially exploit this vulnerability, leading to the execution of arbitrary OS commands and possible system takeover. This is a critical vulnerability as it allows an attacker to cause severe damage. Dell recommends customers to upgrade at the earliest opportunity.

Affected

ProductAffectedFixed inSource
Dell SmartFabric OS1010.5.5.0–CNA
Dell SmartFabric OS1010.5.5.3–CNA
Dell SmartFabric OS1010.5.5.1 (MX)–CNA
Dell SmartFabric OS1010.5.5.2 (MX)–CNA
Dell SmartFabric OS1010.5.4.x–CNA
Dell SmartFabric OS1010.5.4.6 (MX)–CNA
Dell SmartFabric OS1010.5.3.x–CNA
Dell SmartFabric OS1010.5.2.x–CNA

Scores by source

dell (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: partial

References

advisorydell.com/support/kbdoc/en-us/000216584/dsa-2023-124-security-update-for-dell-smartfabric-os10-multiple-vulnerabilities