by Kastro
Paper/Archive/CVE-2024-22425

CVE-2024-22425

Dell RecoverPoint for VMs — Dell RecoverPoint for Virtual Machines 5.3.x, 6.0.SP1 contains a brute force/dictionary attack vulnerability.

EPSS 0.5%CVSS 9.8
critical.is priorityof 100
37
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 39.8.398 × 208.0No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Dell RecoverPoint for Virtual Machines 5.3.x, 6.0.SP1 contains a brute force/dictionary attack vulnerability. An unauthenticated remote attacker could potentially exploit this vulnerability, leading to launch a brute force attack or a dictionary attack against the RecoverPoint login form. This allows attackers to brute-force the password of valid users in an automated manner.

Affected

ProductAffectedFixed inSource
RecoverPoint for VMs5.3 SP2–CNA
RecoverPoint for VMs5.3 SP2 P1–CNA
RecoverPoint for VMs5.3 SP2 P2–CNA
RecoverPoint for VMs5.3 SP2 P4–CNA
RecoverPoint for VMs5.3 SP3 P1–CNA
RecoverPoint for VMs5.3 SP3 P2–CNA
RecoverPoint for VMs6.0.SP1–CNA
recoverpoint_for_virtual_machines5.3SP2–CISA-ADP
recoverpoint_for_virtual_machines5.3SP2P1–CISA-ADP
recoverpoint_for_virtual_machines5.3SP2P2–CISA-ADP
recoverpoint_for_virtual_machines5.3SP2P4–CISA-ADP
recoverpoint_for_virtual_machines5.3 SP3P1–CISA-ADP

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
dell (CNA)6.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: partial

References

advisorydell.com/support/kbdoc/en-us/000222133/dsa-2024-092-security-update-for-dell-recoverpoint-for-virtual-machines-multiple-vulnerabilitiesadvisorydell.com/support/kbdoc/en-us/000228154/dsa-2024-369-security-update-for-dell-recoverpoint-for-virtual-machines-multiple-vulnerabilities