It has been discovered that there is a high-severity vulnerability in Dell Command Configure that could potentially be exploited by malicious users to compromise the system.
The vulnerability has been given a CVSS base score of 7.3 and has been classified as CVE-2023-43086. It is important to take note of this vulnerability and take appropriate measures to mitigate the risk of exploitation.
During an application upgrade, a local malicious user can modify files inside the installation folder, which could escalate privileges.
For the impacted products, the company released the remediated versions.
Dell Command | Configure is a software package that allows you to configure the BIOS on Dell client systems. Using the Dell Command | Configure User Interface (UI) or Command Line Interface (CLI), IT administrators can use this tool to configure BIOS settings and build BIOS packages.
“Dell Command | Configure remediation is available for an improper access control vulnerability that malicious users could exploit to compromise the affected system,” reads Dell Security advisory.
In the upcoming webinar, Karthik Krishnamoorthy, CTO and Vivek Gopalan, VP of Products at Indusface demonstrate how APIs could be hacked. The session will cover: an exploit of OWASP API Top 10 vulnerability, a brute force account take-over (ATO) attack on API, a DDoS attack on an API, how a WAAP could bolster security over an API gateway
When a system fails to appropriately limit or enforce access to resources—like files, directories, network resources, or application functions—it creates a vulnerability known as improper access control.
Weak access controls, insufficient authorization checks, and excessively permissive access are examples of improper access control flaws.
Dell Command | Configure, versions before 4.11.0 have a vulnerability related to “improper access control.”
Hence, it is advised that you use the most recent version of the available software and install security patches as soon as possible.
Experience how StorageGuard eliminates the security blind spots in your storage systems by trying a 14-day free trial.
In a recent development, the SPAWNCHIMERA malware family has been identified exploiting the buffer overflow…
A significant vulnerability in Sitevision CMS, versions 10.3.1 and earlier, has been identified, allowing attackers…
Chinese cybersecurity entities have accused the U.S. National Security Agency (NSA) of orchestrating a cyberattack…
The ACRStealer malware, an infostealer disguised as illegal software such as cracks and keygens, has…
A security vulnerability in Nagios XI 2024R1.2.2, tracked as CVE-2024-54961, has been disclosed, allowing unauthenticated…
Ubiquiti Networks has issued an urgent security advisory (Bulletin 046) warning of multiple critical vulnerabilities…