9.8

CVE-2024-22426

Dell RecoverPoint for Virtual Machines 5.3.x, 6.0.SP1 contains an OS Command injection vulnerability. An unauthenticated remote attacker could potentially exploit this vulnerability, leading to execute arbitrary operating system commands, which will get executed in the context of the root user, resulting in a complete system compromise.

Data is provided by the National Vulnerability Database (NVD)
Dell ≫ Recoverpoint For Virtual Machines Version5.3 Updatesp2
Dell ≫ Recoverpoint For Virtual Machines Version5.3 Updatesp2_p1
Dell ≫ Recoverpoint For Virtual Machines Version5.3 Updatesp2_p2
Dell ≫ Recoverpoint For Virtual Machines Version5.3 Updatesp2_p4
Dell ≫ Recoverpoint For Virtual Machines Version5.3 Updatesp3_p1
Dell ≫ Recoverpoint For Virtual Machines Version5.3 Updatesp3_p2
Dell ≫ Recoverpoint For Virtual Machines Version6.0 Updatesp1
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 1.13% 0.774
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 9.8 3.9 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
security_alert@emc.com 7.2 1.2 5.9
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CWE-434 Unrestricted Upload of File with Dangerous Type

The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.