High severity · published Feb 2, 2023
CVE-2023-24574
Dell Enterprise SONiC OS, 3.5.3, 4.0.0, 4.0.1, 4.0.2, contains an "Uncontrolled Resource Consumption vulnerability" in authentication component
7.5
CVSS
0.9%
EPSS
No
On KEV
Description
Dell Enterprise SONiC OS, 3.5.3, 4.0.0, 4.0.1, 4.0.2, contains an "Uncontrolled Resource Consumption vulnerability" in authentication component. An unauthenticated remote attacker could potentially exploit this vulnerability, leading to uncontrolled resource consumption by creating permanent home directories for unauthenticated users.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.9% · higher than 59% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ES
Enterprise SONiC OS · Dell
through 3.5.3, 3.5.4, 4.0.0, 4.0.1, 4.0.2 · source: vendor
ES
Enterprise Sonic Distribution · Dell
3.5.3 before 4.0.3 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-24574
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-24574
Vendor Advisory
https://www.dell.com/support/kbdoc/en-us/000208165/dsa-2023-039-dell-emc-enterprise-sonic-security-update-for-an-uncontrolled-resource-consumption-vulnerability
More from Enterprise SONiC OS
9.8
CVE-2024-45764
Dell Enterprise SONiC OS, version(s) 4.1.x, 4.2.x, contain(s) a Missing Critical Step in Authentication vulnerability
9.8
CVE-2023-32484
Dell Networking Switches running Enterprise SONiC versions 4.1.0, 4.0.5, 3.5.4 and below contains an improper input validation vulnerability
7.5
CVE-2025-38741
Dell Enterprise SONiC OS, version 4.5.0, contains a cryptographic key vulnerability in SSH
7.5
CVE-2022-34425
Dell Enterprise SONiC OS, 4.0.0, 4.0.1, contain a cryptographic key vulnerability in SSH
7.2
CVE-2024-45763
Dell Enterprise SONiC OS, version(s) 4.1.x, 4.2.x, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability