CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2023-32484
https://notcve.org/view.php?id=CVE-2023-32484
Dell Networking Switches running Enterprise SONiC versions 4.1.0, 4.0.5, 3.5.4 and below contains an improper input validation vulnerability. A remote unauthenticated malicious user may exploit this vulnerability and escalate privileges up to the highest administrative level. This is a Critical vulnerability affecting certain protocols, Dell recommends customers to upgrade at the earliest opportunity. Los conmutadores de red Dell que ejecutan Enterprise SONiC versiones 4.1.0, 4.0.5, 3.5.4 y siguientes contienen una vulnerabilidad de validación de entrada incorrecta. Un usuario malicioso remoto no autenticado puede aprovechar esta vulnerabilidad y escalar privilegios hasta el nivel administrativo más alto. • https://www.dell.com/support/kbdoc/en-us/000216586/dsa-2023-284-security-update-for-dell-emc-enterprise-sonic-os-command-injection-vulnerability-when-using-remote-user-authentication • CWE-20: Improper Input Validation •
CVSS: 7.1EPSS: 0%CPEs: 1EXPL: 0CVE-2021-36309
https://notcve.org/view.php?id=CVE-2021-36309
Dell Enterprise SONiC OS, versions 3.3.0 and earlier, contains a sensitive information disclosure vulnerability. An authenticated malicious user with access to the system may use the TACACS\Radius credentials stored to read sensitive information and use it in further attacks. Dell Enterprise SONiC OS, versiones 3.3.0 y anteriores, contiene una vulnerabilidad de divulgación de información confidencial. Un usuario malicioso autenticado con acceso al sistema puede usar las credenciales TACACS\Radius almacenadas para leer información confidencial y usarla en posteriores ataques • https://www.dell.com/support/kbdoc/en-us/000191690/DSA-2021-190-Dell-Enterprise-SONiC-OS-Security-Update-for-an-information-disclosure-Vulnerability • CWE-256: Plaintext Storage of a Password CWE-522: Insufficiently Protected Credentials •