CVE-2020-5350 Command injection in Integrated Data Protection Appliance
Remote authenticated root users can inject commands into ACM APIs, enabling malicious code execution and password manipulation on Dell EMC IDPA.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-5350?
CVE-2020-5350 is a high-severity command injection vulnerability in Dell Integrated Data Protection Appliance, published on 15 Apr 2020. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Dell EMC Integrated Data Protection Appliance versions 2.0, 2.1, 2.2, 2.3, 2.4 contain a command injection vulnerability in the ACM component. A remote authenticated malicious user with root privileges could inject parameters in the ACM component APIs that could lead to manipulation of passwords and execution of malicious commands on ACM component.
Weakness: CWE-78
Which versions are affected by CVE-2020-5350?
It affects 1 product.
Products include Dell Emc Integrated Data Protection Appliance.
How do I fix CVE-2020-5350?
No fix has been published for CVE-2020-5350 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2020-5350 being exploited?
There is no known exploitation of CVE-2020-5350 in the wild and no public exploit code.
Other vulnerabilities in Dell Integrated Data Protection Appliance
Sources
Also known as GHSA-hfm4-3rg3-394f.