CVE-2024-45765

Published Nov 8, 2024

Last updated 4 days ago

CVSS high 7.2

Overview

Description: Dell Enterprise SONiC OS, version(s) 4.1.x, 4.2.x, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Command execution. This is a critical severity vulnerability as it allows high privilege OS commands to be executed with a less privileged role; so Dell recommends customers to upgrade at the earliest opportunity.
Source: security_alert@emc.com
NVD status: Analyzed

Risk scores

CVSS 3.1

Type: Primary
Base score: 7.2
Impact score: 5.9
Exploitability score: 1.2
Vector string: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Severity: HIGH

Weaknesses

security_alert@emc.com: CWE-78

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:o:dell:enterprise_sonic_distribution:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "B562D424-8BFD-4EB8-B420-BBB9A9487BFD",
            "versionEndExcluding": "4.1.6",
            "versionStartIncluding": "4.1.0"
          },
          {
            "criteria": "cpe:2.3:o:dell:enterprise_sonic_distribution:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "062610CC-696D-4014-AB7A-BA99EA7E0A24",
            "versionEndExcluding": "4.2.2",
            "versionStartIncluding": "4.2.0"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

Overview

Risk scores

CVSS 3.1

Weaknesses

Social media

Configurations

References