Thursday, November 14, 2024
Homecyber securityDell Command Configure Vulnerability Let Attackers Compromise Vulnerable Systems

Dell Command Configure Vulnerability Let Attackers Compromise Vulnerable Systems

Published on

Malware protection

It has been discovered that there is a high-severity vulnerability in Dell Command Configure that could potentially be exploited by malicious users to compromise the system.

The vulnerability has been given a CVSS base score of 7.3 and has been classified as CVE-2023-43086. It is important to take note of this vulnerability and take appropriate measures to mitigate the risk of exploitation.

During an application upgrade, a local malicious user can modify files inside the installation folder, which could escalate privileges.

- Advertisement - SIEM as a Service

For the impacted products, the company released the remediated versions.

Specifics of the Vulnerability

Dell Command | Configure is a software package that allows you to configure the BIOS on Dell client systems. Using the Dell Command | Configure User Interface (UI) or Command Line Interface (CLI), IT administrators can use this tool to configure BIOS settings and build BIOS packages.

“Dell Command | Configure remediation is available for an improper access control vulnerability that malicious users could exploit to compromise the affected system,” reads Dell Security advisory.

Document
Free Webinar

Live API Attack Simulation Webinar

In the upcoming webinar, Karthik Krishnamoorthy, CTO and Vivek Gopalan, VP of Products at Indusface demonstrate how APIs could be hacked. The session will cover: an exploit of OWASP API Top 10 vulnerability, a brute force account take-over (ATO) attack on API, a DDoS attack on an API, how a WAAP could bolster security over an API gateway

When a system fails to appropriately limit or enforce access to resources—like files, directories, network resources, or application functions—it creates a vulnerability known as improper access control.

Weak access controls, insufficient authorization checks, and excessively permissive access are examples of improper access control flaws.

Affected Versions

Dell Command | Configure, versions before 4.11.0 have a vulnerability related to “improper access control.”

Affected Products and Remediation

Hence, it is advised that you use the most recent version of the available software and install security patches as soon as possible.

Experience how StorageGuard eliminates the security blind spots in your storage systems by trying a 14-day free trial.

Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Latest articles

Google Unveils New Intelligent, Real-Time Protections for Android Users

Google has once again raised the bar for mobile security by introducing two new...

Chinese National Faces 20 Years of Jail Time for Laundering Millions in Crypto

Daren Li, 41, a dual citizen of China and St. Kitts and Nevis, and...

Google to Issue CVEs for Critical Cloud Vulnerabilities

Google Cloud has announced a significant step forward in its commitment to transparency and...

GitLab Patches Critical Flaws Leads to Unauthorized Access to Kubernetes Cluster

GitLab has rolled out critical security updates to address multiple vulnerabilities in its Community...

Free Webinar

Protect Websites & APIs from Malware Attack

Malware targeting customer-facing websites and API applications poses significant risks, including compliance violations, defacements, and even blacklisting.

Join us for an insightful webinar featuring Vivek Gopalan, VP of Products at Indusface, as he shares effective strategies for safeguarding websites and APIs against malware.

Discussion points

Scan DOM, internal links, and JavaScript libraries for hidden malware.
Detect website defacements in real time.
Protect your brand by monitoring for potential blacklisting.
Prevent malware from infiltrating your server and cloud infrastructure.

More like this

Google Unveils New Intelligent, Real-Time Protections for Android Users

Google has once again raised the bar for mobile security by introducing two new...

Chinese National Faces 20 Years of Jail Time for Laundering Millions in Crypto

Daren Li, 41, a dual citizen of China and St. Kitts and Nevis, and...

Google to Issue CVEs for Critical Cloud Vulnerabilities

Google Cloud has announced a significant step forward in its commitment to transparency and...