Vulnerability · Published Apr 12, 2021 · Assigned by dell

CVE-2021-21524

Critical 9.8

In plain English

A critical-severity unsafe deserialization in Dell EMC Storage Monitoring and Reporting from Dell. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 3.6% (higher than 89% of all known vulnerabilities).

Severity (CVSS 3.0)9.8Critical

Exploit odds (30 days)3.6%top 10.5% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

Dell SRM versions prior to 4.5.0.1 and Dell SMR versions prior to 4.5.0.1 contain an Untrusted Deserialization Vulnerability. A remote unauthenticated attacker may potentially exploit this vulnerability, leading to arbitrary privileged code execution on the vulnerable application. The severity is Critical as this may lead to system compromise by unauthenticated attackers.

Affected products (as reported)

Vendor	Product	Versions
Dell	Dell EMC Storage Monitoring and Reporting	unspecified – before 4.5.0.1

Weakness: CWE-502 · Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

https://www.dell.com/support/kbdoc/en-us/000184753/dsa-2021-054-dell-emc-srm-and-dell-emc-storage-monitoring-and-reporting-smr-security-update-for-multiple-vulnerabilities x_refsource_MISC