CVE-2023-28055

· HIGHModified

← All CVEs

CVSS v3.1

8.8

EPSS

0.34%

Published

Sep 27, 2023

Modified

Nov 21, 2024

Public PoC / Exploit

All weaponized →

No public PoC or exploit code indexed for this CVE.

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

Dell NetWorker, Version 19.7 has an improper authorization vulnerability in the NetWorker client. An unauthenticated attacker within the same network could potentially exploit this by manipulating a command leading to gain of complete access to the server file further resulting in information leaks, denial of service, and arbitrary code execution. Dell recommends customers to upgrade at the earliest opportunity.

CVSS Vector

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-285

Affected Products (4)

dell · networker (up to 19.7.0.5)vulnerable

dell · networker (up to 19.8.0.3)vulnerable

dell · networker (up to 19.9.0.2)vulnerable

dell · networkervulnerable

References (2)

https://www.dell.com/support/kbdoc/en-us/000218003/dsa-2023-294-security-update-for-dell-networker-nw-client-vulnerabilities

PatchVendor Advisory

https://www.dell.com/support/kbdoc/en-us/000218003/dsa-2023-294-security-update-for-dell-networker-nw-client-vulnerabilities

PatchVendor Advisory

KEV Catalog EPSS Scores Vendors All CVEs