RCE in Dell Networker
CVE-2023-25539
Dell NetWorker 19.6.1.2, contains an OS command injection Vulnerability in the NetWorker client. A remote unauthenticated attacker could potentially exploit this vulnerability, leading to the execution of arbitrary OS commands on the application's underlying OS, with the privileges of the vulnerable application. This is a high severity vulnerability as the exploitation allows an attacker to take complete control of a system, so Dell recommends customers to upgrade at the earliest opportunity.
Vulnerability class: RCE (Remote Code Execution)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 8.4 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.015 (72.9th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 73rd percentile — 72.9% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.015 · newest: 0.015 · change: 0.000
Affected products
- Dell Networker — versions 19.7.1
- Dell Networker Nve — versions NetWorker 19.6.1.2 Linux and prior releases, NetWorker 19.7.0.3 Linux and prior releases, 19.7.1 Linux
- Linux Kernel
Weakness classification (CWE)
References
- www.dell.com/support/kbdoc/en-us/000211267/dsa-2023-060-dell-networker-security… (vendor-advisory, Vendor Advisory)
Frequently asked questions
- What is CVE-2023-25539?
- CVE-2023-25539 is a high-severity vulnerability in Dell Networker, classified under Code Injection. CVSS score: 8.4/10. Published 2023-05-31.
- How severe is CVE-2023-25539?
- High severity. CVSS v3 base score is 8.4 out of 10.