CVE-2024-45764

Dell Enterprise SONiC OS, version(s) 4.1.x, 4.2.x, contain(s) a Missing Critical Step in Authentication vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Protection mechanism bypass. This is a critical severity vulnerability so Dell recommends customers to upgrade at the earliest opportunity.

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://www.dell.com/support/kbdoc/en-us/000245655/dsa-2024-449-security-update-for-dell-enterprise-sonic-distribution-vulnerabilities	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:o:dell:enterprise_sonic_distribution::::::::
	cpe:2.3:o:dell:enterprise_sonic_distribution::::::::

History

13 Nov 2024, 19:08

Type	Values Removed	Values Added
CPE		cpe:2.3:o:dell:enterprise_sonic_distribution::::::::
First Time		Dell Dell enterprise Sonic Distribution
Summary		(es) Dell Enterprise SONiC OS, versiones 4.1.x y 4.2.x, contiene una vulnerabilidad de falta de paso crítico en la autenticación. Un atacante no autenticado con acceso remoto podría aprovechar esta vulnerabilidad, lo que provocaría la omisión del mecanismo de protección. Se trata de una vulnerabilidad de gravedad crítica, por lo que Dell recomienda a los clientes que actualicen la versión lo antes posible.
References	~~() https://www.dell.com/support/kbdoc/en-us/000245655/dsa-2024-449-security-update-for-dell-enterprise-sonic-distribution-vulnerabilities -~~	() https://www.dell.com/support/kbdoc/en-us/000245655/dsa-2024-449-security-update-for-dell-enterprise-sonic-distribution-vulnerabilities - Vendor Advisory
CWE		NVD-CWE-Other
CVSS	v2 : ~~unknown~~ v3 : ~~9.0~~	v2 : unknown v3 : 9.8

08 Nov 2024, 16:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-11-08 16:15

Updated : 2024-11-13 19:08

NVD link : CVE-2024-45764

Mitre link : CVE-2024-45764

CVE.ORG link : CVE-2024-45764

JSON object : View

Products Affected

dell

enterprise_sonic_distribution

CWE

NVD-CWE-Other CWE-304

Missing Critical Step in Authentication

{"id": "CVE-2024-45764", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}, {"type": "Secondary", "source": "security_alert@emc.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.0, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 2.2}]}, "published": "2024-11-08T16:15:23.070", "references": [{"url": "https://www.dell.com/support/kbdoc/en-us/000245655/dsa-2024-449-security-update-for-dell-enterprise-sonic-distribution-vulnerabilities", "tags": ["Vendor Advisory"], "source": "security_alert@emc.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}, {"type": "Secondary", "source": "security_alert@emc.com", "description": [{"lang": "en", "value": "CWE-304"}]}], "descriptions": [{"lang": "en", "value": "Dell Enterprise SONiC OS, version(s) 4.1.x, 4.2.x, contain(s) a Missing Critical Step in Authentication vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Protection mechanism bypass. This is a critical severity vulnerability so Dell recommends customers to upgrade at the earliest opportunity."}, {"lang": "es", "value": "Dell Enterprise SONiC OS, versiones 4.1.x y 4.2.x, contiene una vulnerabilidad de falta de paso cr\u00edtico en la autenticaci\u00f3n. Un atacante no autenticado con acceso remoto podr\u00eda aprovechar esta vulnerabilidad, lo que provocar\u00eda la omisi\u00f3n del mecanismo de protecci\u00f3n. Se trata de una vulnerabilidad de gravedad cr\u00edtica, por lo que Dell recomienda a los clientes que actualicen la versi\u00f3n lo antes posible."}], "lastModified": "2024-11-13T19:08:29.580", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:dell:enterprise_sonic_distribution:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B562D424-8BFD-4EB8-B420-BBB9A9487BFD", "versionEndExcluding": "4.1.6", "versionStartIncluding": "4.1.0"}, {"criteria": "cpe:2.3:o:dell:enterprise_sonic_distribution:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "062610CC-696D-4014-AB7A-BA99EA7E0A24", "versionEndExcluding": "4.2.2", "versionStartIncluding": "4.2.0"}], "operator": "OR"}]}], "sourceIdentifier": "security_alert@emc.com"}