Vulnerability · Published May 31, 2023 · Assigned by dell
CVE-2023-25539
High 8.4
In plain English
A high-severity code injection in NetWorker NVE from Dell. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.5% (higher than 74% of all known vulnerabilities).
Official description
Dell NetWorker 19.6.1.2, contains an OS command injection Vulnerability in the NetWorker client. A remote unauthenticated attacker could potentially exploit this vulnerability, leading to the execution of arbitrary OS commands on the application's underlying OS, with the privileges of the vulnerable application. This is a high severity vulnerability as the exploitation allows an attacker to take complete control of a system, so Dell recommends customers to upgrade at the earliest opportunity.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Dell | NetWorker NVE | NetWorker 19.6.1.2 Linux and prior releases, NetWorker 19.7.0.3 Linux and prior releases, 19.7.1 Linux |
Weakness: CWE-94 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H