CVE-2024-22428

2024-01-1604:15:08

CWE-276

[email protected]

web.nvd.nist.gov

dell

idrac

service module

incorrect default permissions

vulnerability

local privilege escalation

arbitrary code execution

cve-2024-22428

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

0.0004 Low

EPSS

Percentile

5.1%

JSON

Dell iDRAC Service Module, versions 5.2.0.0 and prior, contain an Incorrect Default Permissions vulnerability. It may allow a local unprivileged user to escalate privileges and execute arbitrary code on the affected system. Dell recommends customers upgrade at the earliest opportunity.

Affected configurations

NVD

Node

dellemc_idrac_service_moduleRange≤5.2.0.0

CPENameOperatorVersion
dell:emc_idrac_service_moduledell emc idrac service modulele5.2.0.0

CPE	Name	Operator	Version
dell:emc_idrac_service_module	dell emc idrac service module	le	5.2.0.0

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "iDRAC Service Module (iSM)",
    "vendor": "Dell",
    "versions": [
      {
        "lessThanOrEqual": " 5.2.0.0",
        "status": "affected",
        "version": "5.1.0.0",
        "versionType": "semver"
      }
    ]
  }
]