CVE-2023-48667OS Command Injection in Dell Apex Protection Storage

Severity
7.2HIGHNVD
EPSS
0.0%
top 90.46%
CISA KEV
Not in KEV
Exploit
No known exploits
Timeline
PublishedDec 14

Description

Dell PowerProtect DD, versions prior to 7.13.0.10, LTS 7.7.5.25, LTS 7.10.1.15, 6.2.1.110 contain an OS command injection vulnerability in administrator CLI. A remote high privileged attacker could potentially exploit this vulnerability, leading to the execution of arbitrary OS commands on the application's underlying OS to bypass security restriction. Exploitation may lead to a system take over by an attacker.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HExploitability: 1.2 | Impact: 5.9

Affected Packages6 packages

NVDdell/powerprotect_data_domain7.07.12.0.0+1
CVEListV5dell/powerprotect_ddVersions prior to 7.13.0.10, LTS 7.7.5.25, LTS 7.10.1.15, 6.2.1.110
NVDdell/emc_data_domain_os7.07.12.0.0+3

🔴Vulnerability Details

2
CVEList
CVE-2023-48667: Dell PowerProtect DD, versions prior to 72023-12-14
GHSA
GHSA-wr5w-23w5-xf72: Dell PowerProtect DD, versions prior to 72023-12-14
CVE-2023-48667 — OS Command Injection in Dell | cvebase