// For flags

CVE-2018-15766

Dell Encryption and Dell Endpoint Security Suite Enterprise Security Policy Overwrite Vulnerability

Severity Score

7.5
*CVSS v3

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

On install, Dell Encryption versions prior 10.0.1 and Dell Endpoint Security Suite Enterprise versions prior 2.0.1 will overwrite and manually set the "Minimum Password Length" group policy object to a value of 1 on that device. This allows for users to bypass any existing policy for password length and potentially create insecure password on their device. This value is defined during the installation of the "Encryption Management Agent" or "EMAgent" application. There are no other known values modified.

A la hora de instalarse, Dell Encryption en versiones anteriores a la 10.0.1 y Dell Endpoint Security Suite Enterprise en versiones anteriores a la 2.0.1 sobrescribirá y establecerá manualmente el objeto de política de grupo "Minimum Password Length" a un valor de 1 en ese dispositivo. Esto permite que los usuarios omitan cualquier política existente para el largo de contraseñas y puedan crear contraseñas inseguras en su dispositivo. Este valor se define durante la instalación de las aplicaciones "Encryption Management Agent" o "EMAgent". No hay ningún otro valor conocido modificado.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
None
Attack Vector
Network
Attack Complexity
Low
Authentication
None
Confidentiality
None
Integrity
Partial
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2018-08-23 CVE Reserved
  • 2018-10-11 CVE Published
  • 2024-08-18 EPSS Updated
  • 2024-09-16 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-521: Weak Password Requirements
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Dell
Search vendor "Dell"
 Encryption
Search vendor "Dell" for product "Encryption"
 < 10.0.1
Search vendor "Dell" for product "Encryption" and version " < 10.0.1"
-
Affected
Dell
Search vendor "Dell"
 Endpoint Security Suite Enterprise
Search vendor "Dell" for product "Endpoint Security Suite Enterprise"
 < 2.0.1
Search vendor "Dell" for product "Endpoint Security Suite Enterprise" and version " < 2.0.1"
-
Affected