CVE-2019-3710 DSA-2019-034: Dell EMC Networking OS10 Undocumented Default Cryptographic Key Vulnerability
An attacker can intercept communications or gain elevated privileges on Dell EMC Networking OS10 devices due to undocumented default cryptographic keys.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2019-3710?
CVE-2019-3710 is a high-severity vulnerability in Dell EMC Networking OS10, published on 28 Mar 2019. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Dell EMC Networking OS10 versions prior to 10.4.3 contain a cryptographic key vulnerability due to an underlying application using undocumented, pre-installed X.509v3 key/certificate pairs. An unauthenticated remote attacker with the knowledge of the default keys may potentially be able to intercept communications or operate the system with elevated privileges.
Weakness: CWE-798
Which versions are affected by CVE-2019-3710?
It affects 1 product.
Products include Dell Emc Networking Os10.
How do I fix CVE-2019-3710?
No fix has been published for CVE-2019-3710 yet. Limit exposure of the affected software until one is available.
Is CVE-2019-3710 being exploited?
There is no known exploitation of CVE-2019-3710 in the wild and no public exploit code.
Sources
Also known as GHSA-343g-4665-8j56.