by Kastro
Paper/Archive/CVE-2024-22426

CVE-2024-22426

Dell RecoverPoint for VMs — Dell RecoverPoint for Virtual Machines 5.3.x, 6.0.SP1 contains an OS Command injection vulnerability.

EPSS 1%CVSS 9.8
critical.is priorityof 100
44
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 72.5.725 × 2014.5No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Dell RecoverPoint for Virtual Machines 5.3.x, 6.0.SP1 contains an OS Command injection vulnerability. An unauthenticated remote attacker could potentially exploit this vulnerability, leading to execute arbitrary operating system commands, which will get executed in the context of the root user, resulting in a complete system compromise.

Affected

ProductAffectedFixed inSource
RecoverPoint for VMs5.3 SP2–CNA
RecoverPoint for VMs5.3 SP2 P1–CNA
RecoverPoint for VMs5.3 SP2 P2–CNA
RecoverPoint for VMs5.3 SP2 P4–CNA
RecoverPoint for VMs5.3 SP3 P1–CNA
RecoverPoint for VMs5.3 SP3 P2–CNA
RecoverPoint for VMs6.0.SP1–CNA
recoverpoint_for_virtual_machines5.3_sp2–CISA-ADP
recoverpoint_for_virtual_machines5.3_sp2_p1–CISA-ADP
recoverpoint_for_virtual_machines5.3_sp2_p2–CISA-ADP
recoverpoint_for_virtual_machines5.3_sp2_p4–CISA-ADP
recoverpoint_for_virtual_machines5.3_sp3_p1–CISA-ADP

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
dell (CNA)7.2CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

advisorydell.com/support/kbdoc/en-us/000222133/dsa-2024-092-security-update-for-dell-recoverpoint-for-virtual-machines-multiple-vulnerabilitiesadvisorydell.com/support/kbdoc/en-us/000228154/dsa-2024-369-security-update-for-dell-recoverpoint-for-virtual-machines-multiple-vulnerabilities