Lucene search

DellCVELIST:CVE-2024-39585

HistorySep 06, 2024 - 4:18 a.m.

CVE-2024-39585

2024-09-0604:18:27

CWE-259

dell

www.cve.org

dell smartfabric os10

software

hard-coded password

vulnerability

remote access

client-side request forgery

information disclosure

CVSS3

7.9

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:H/A:H

EPSS

0.001

Percentile

20.2%

JSON

Dell SmartFabric OS10 Software, version(s) 10.5.5.4 through 10.5.5.10 and 10.5.6.x, contain(s) an Use of Hard-coded Password vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Client-side request forgery and Information disclosure.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "SmartFabric OS10 Software",
    "vendor": "Dell",
    "versions": [
      {
        "status": "affected",
        "version": "10.5.6.x"
      },
      {
        "lessThanOrEqual": "10.5.5.10",
        "status": "affected",
        "version": "10.5.5.4",
        "versionType": "semver"
      }
    ]
  }
]

References

www.dell.com/support/kbdoc/en-us/000228355/dsa-2024-376-security-update-for-dell-networking-os10-vulnerability

CVSS3

7.9

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:H/A:H

EPSS

0.001

Percentile

20.2%

JSON

Related for CVELIST:CVE-2024-39585