Dell Security Update, Patch for Multiple Critical Vulnerabilities

Dell Technologies has released a security advisory addressing multiple critical vulnerabilities that could expose affected systems to exploitation by malicious actors.

Customers are strongly encouraged to review the findings and update their systems accordingly.

This update includes remediation for two critical CVEs affecting several Dell products. Failure to address these vulnerabilities could result in system compromise, including unauthorized data access and remote code execution.

2024 MITRE ATT&CK Evaluation Results for SMEs & MSPs -> Download Free Guide

Dell Security Update

The vulnerabilities, if exploited, could allow attackers to execute arbitrary code remotely or gain unauthorized access to sensitive data stored on affected systems. This poses a significant risk to business continuity and data integrity.

CVE-2024-37143: Improper Link Resolution Before File Access

CVE-2024-37143 is a critical vulnerability identified as “Improper Link Resolution Before File Access,” affecting several Dell products including Dell PowerFlex appliances and racks, Dell InsightIQ, and Dell Data Lakehouse.

This vulnerability allows an unauthenticated attacker with remote access to exploit improper file link resolution mechanisms, potentially executing arbitrary code on the affected systems.

The vulnerability poses a severe threat due to its ease of exploitation and the high impact on the system’s confidentiality, integrity, and availability. It has been assigned a CVSS base score of 10.0, the highest possible, reflecting its critical nature

CVE-2024-37144: Insecure Storage of Sensitive Information

CVE-2024-37144 is a high-severity vulnerability classified as “Insecure Storage of Sensitive Information,” affecting multiple Dell products, such as Dell PowerFlex appliances, racks, and custom nodes, as well as Dell InsightIQ and Dell Data Lakehouse.

This vulnerability arises from improper handling of sensitive data, allowing a high-privileged attacker with local access to potentially disclose sensitive information.

Such exploitation could enable the attacker to gain unauthorized access to resources within the cluster, posing significant risks to system confidentiality and integrity. 

Dell strongly advises customers to evaluate the CVSS base scores and apply relevant updates promptly to mitigate risks.

Affected Products & Remediation

The following table outlines the affected products, versions, and the remediated versions available:

Product	Software/Firmware	Affected Versions
Dell PowerFlex appliance	Intelligent Catalog (IC)	Versions prior to 46.381.00
Dell PowerFlex appliance	Intelligent Catalog (IC)	Versions prior to 46.376.00
Dell PowerFlex rack	RCM (3.8.x train)	Versions prior to 3.8.1.0
Dell PowerFlex rack	RCM (3.7.x train)	Versions prior to 3.7.6.0
Dell PowerFlex custom node	PowerFlex Manager	Versions prior to 4.6.1.0
Dell InsightIQ	Installation Package	Versions prior to 5.1.1
Dell Data Lakehouse	Bundle	Versions prior to 1.2.0.0

Dell Technologies assumes no liability for any damages arising from the utilization of this advisory. Customers are responsible for assessing the impact on their environment and applying updates as necessary.

Investigate Real-World Malicious Links, Malware & Phishing Attacks With ANY.RUN – Try for Free