Vulnerability · Published Feb 16, 2024 · Assigned by dell
CVE-2024-22425
Medium 6.5
In plain English
A medium-severity security flaw in RecoverPoint for VMs from Dell. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 40% of all known vulnerabilities).
Official description
Dell RecoverPoint for Virtual Machines 5.3.x, 6.0.SP1 contains a brute force/dictionary attack vulnerability. An unauthenticated remote attacker could potentially exploit this vulnerability, leading to launch a brute force attack or a dictionary attack against the RecoverPoint login form. This allows attackers to brute-force the password of valid users in an automated manner.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Dell | RecoverPoint for VMs | 5.3 SP25.3 SP2 P15.3 SP2 P25.3 SP2 P45.3 SP3 P15.3 SP3 P26.0.SP1 |
Weakness: CWE-307 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
References
- https://www.dell.com/support/kbdoc/en-us/000222133/dsa-2024-092-security-update-for-dell-recoverpoint-for-virtual-machines-multiple-vulnerabilities vendor-advisory
- https://www.dell.com/support/kbdoc/en-us/000228154/dsa-2024-369-security-update-for-dell-recoverpoint-for-virtual-machines-multiple-vulnerabilities vendor-advisory