CVE-2024-45765 - Dell Enterprise SONiC OS, version(s) 4.1.x, 4.2.x, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability

Back Back to CVE browser

CRITICAL

Dell Enterprise SONiC OS, version(s) 4.1.x, 4.2.x, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability

Published Nov 8, 2024

9.1

CRITICAL

CVSS 3.1

EPSS 1.40%

Description

Dell Enterprise SONiC OS, version(s) 4.1.x, 4.2.x, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Command execution. This is a critical severity vulnerability as it allows high privilege OS commands to be executed with a less privileged role; so Dell recommends customers to upgrade at the earliest opportunity.

Affected products

Vendor Dell Product Enterprise SONiC OS Default
unaffected
Affected
- < 4.1.6
- < 4.2.2

Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).

Vendor	Product	Default status	Versions
Dell	Enterprise SONiC OS	unaffected	Affected < 4.1.6 < 4.2.2

Vendor Dell Product Enterprise Sonic OS Default
unknown
Affected
- ≥ 4.1.0, < 4.1.6
- ≥ 4.2.0, < 4.2.2

Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).

Vendor	Product	Default status	Versions
Dell	Enterprise Sonic OS	unknown	Affected ≥ 4.1.0, < 4.1.6 ≥ 4.2.0, < 4.2.2

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-78

OS Command Injection

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-41588
Advisory
https://www.dell.com/support/kbdoc/en-us/000245655/dsa-2024-449-security-update-for-dell-enterprise-sonic-distribution-vulnerabilities
vendor-advisoryVendor Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-41588		Advisory
https://www.dell.com/support/kbdoc/en-us/000245655/dsa-2024-449-security-update-for-dell-enterprise-sonic-distribution-vulnerabilities		vendor-advisoryVendor Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner dell

Published Nov 8, 2024

Updated Nov 8, 2024

Reserved Sep 6, 2024

Link CVE-2024-45765

CISA Vulnrichment

Updated Nov 8, 2024

NVD

Status Analyzed

Modified Jun 17, 2026

Link CVE-2024-45765

Red Hat

No data

ENISA EUVD

Assigner dell

Published Nov 8, 2024

Updated Nov 8, 2024

Link EUVD-2024-41588

GitHub

No data