CVE-2023-39248

Dell OS10 Networking Switches running 10.5.2.x and above contain an Uncontrolled Resource Consumption (Denial of Service) vulnerability, when switches are configured with VLT and VRRP. A remote unauthenticated user can cause the network to be flooded leading to Denial of Service for actual network users. This is a high severity vulnerability as it allows an attacker to cause an outage of network. Dell recommends customers to upgrade at the earliest opportunity.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://www.dell.com/support/kbdoc/en-us/000220138/dsa-2023-278-dell-networking-os10-security-updates-for-uncontrolled-resource-consumption	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:o:dell:networking_os10:10.5.5.5:*:*:*:*:*:*:*

History

11 Dec 2023, 15:33

Type	Values Removed	Values Added
First Time		Dell networking Os10 Dell
References	~~() https://www.dell.com/support/kbdoc/en-us/000220138/dsa-2023-278-dell-networking-os10-security-updates-for-uncontrolled-resource-consumption -~~	() https://www.dell.com/support/kbdoc/en-us/000220138/dsa-2023-278-dell-networking-os10-security-updates-for-uncontrolled-resource-consumption - Vendor Advisory
CPE		cpe:2.3:o:dell:networking_os10:10.5.5.5:::::::*
CWE		NVD-CWE-noinfo

05 Dec 2023, 06:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2023-12-05 06:15

Updated : 2023-12-11 15:33

NVD link : CVE-2023-39248

Mitre link : CVE-2023-39248

CVE.ORG link : CVE-2023-39248

JSON object : View

Products Affected

dell

networking_os10

CWE

NVD-CWE-noinfo CWE-400

Uncontrolled Resource Consumption

{"id": "CVE-2023-39248", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}, {"type": "Secondary", "source": "security_alert@emc.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2023-12-05T06:15:48.667", "references": [{"url": "https://www.dell.com/support/kbdoc/en-us/000220138/dsa-2023-278-dell-networking-os10-security-updates-for-uncontrolled-resource-consumption", "tags": ["Vendor Advisory"], "source": "security_alert@emc.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}, {"type": "Secondary", "source": "security_alert@emc.com", "description": [{"lang": "en", "value": "CWE-400"}]}], "descriptions": [{"lang": "en", "value": "\nDell OS10 Networking Switches running 10.5.2.x and above contain an Uncontrolled Resource Consumption (Denial of Service) vulnerability, when switches are configured with VLT and VRRP. A remote unauthenticated\u00a0user can cause the network to be flooded leading to Denial of Service for actual network users. This is a high severity vulnerability as it allows an attacker to cause an outage of network. Dell recommends customers to upgrade at the earliest opportunity.\n\n"}, {"lang": "es", "value": "Dell OS10 Networking Switches que ejecutan 10.5.2.x y versiones posteriores contienen una vulnerabilidad de consumo de recursos no controlado (denegaci\u00f3n de servicio) cuando los conmutadores est\u00e1n configurados con VLT y VRRP. Un usuario remoto no autenticado puede provocar que la red se inunde, lo que provocar\u00e1 una denegaci\u00f3n de servicio para los usuarios reales de la red. Esta es una vulnerabilidad de alta gravedad, ya que permite que un atacante provoque una interrupci\u00f3n de la red. Dell recomienda a los clientes actualizar lo antes posible."}], "lastModified": "2023-12-11T15:33:45.650", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:dell:networking_os10:10.5.5.5:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3754A576-AFB2-42EE-94CF-15A7A1392C36"}], "operator": "OR"}]}], "sourceIdentifier": "security_alert@emc.com"}