High severity · published Mar 28, 2024
CVE-2024-25946
Dell vApp Manager, versions prior to 9.2.4.9 contain a Command Injection Vulnerability
8.8
CVSS
1.4%
EPSS
No
On KEV
Description
Dell vApp Manager, versions prior to 9.2.4.9 contain a Command Injection Vulnerability. An authorized attacker could potentially exploit this vulnerability leading to an execution of an inserted command. Dell recommends customers to upgrade at the earliest opportunity.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.4% · higher than 73% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
VA
Virtual Appliance (vApp) Manager · Dell
before 9.2.4.9; before 9.2.4.6; before 5978 · source: vendor
PE
Powermax Eem · Dell
5978 · source: NVD
SE
Solutions Enabler Virtual Appliance · Dell
before 9.2.4.6 · source: NVD
UF
Unisphere For Powermax Virtual Appliance · Dell
before 9.2.4.9 · source: NVD
VA
Virtual Appliance Manager · Dell
before 9.2.4.9; before 9.2.4.6; before 5978 · source: CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-25946
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-25946
Vendor Advisory
https://www.dell.com/support/kbdoc/en-us/000223609/dsa-2024-108-dell-powermaxos-5978-dell-powermax-os-10-0-1-5-dell-powermax-os-10-1-0-2-dell-unisphere-360-unisphere-powermax-unisphere-powermax-vapp-dell-solutions-enabler-vapp-and-dell-powermax-eem-security-update-for-multiple-vulnerabilities
More from Virtual Appliance (vApp) Manager
8.8
CVE-2024-25955
Dell vApp Manager, versions prior to 9.2.4.9 contain a Command Injection Vulnerability