by Kastro
Paper/Archive/CVE-2024-48007

CVE-2024-48007

Dell RecoverPoint for Virtual Machines — Dell RecoverPoint for Virtual Machines 6.0.x contains use of hard-coded credentials vulnerability.

EPSS 0.4%CVSS 9.8
critical.is priorityof 100
37
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 35.9.359 × 207.2No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Dell RecoverPoint for Virtual Machines 6.0.x contains use of hard-coded credentials vulnerability. A Remote unauthenticated attacker could potentially exploit this vulnerability by gaining access to the source code, easily retrieving these secrets and reusing them to access the system leading to gaining access to unauthorized data.

Affected

ProductAffectedFixed inSource
RecoverPoint for Virtual Machines6.0 SP1–CNA
RecoverPoint for Virtual Machines6.0 SP1 P1–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
dell (CNA)5.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: partial

References

advisorydell.com/support/kbdoc/en-us/000259765/dsa-2024-429-security-update-for-dell-recoverpoint-for-virtual-machines-multiple-third-party-component-vulnerabilities