CVE-2022-34394 Security feature bypass in Dell Networking OS10
Remote attackers can bypass certificate validation in Support Assist to perform man-in-the-middle attacks and access limited switch configuration data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-34394?
CVE-2022-34394 is a low-severity vulnerability in Dell Networking OS10, published on 28 Sep 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Dell OS10, version 10.5.3.4, contains an Improper Certificate Validation vulnerability in Support Assist. A remote unauthenticated attacker could potentially exploit this vulnerability, leading to unauthorized access to limited switch configuration data. The vulnerability could be leveraged by attackers to conduct man-in-the-middle attacks to gain access to the Support Assist information.
Weakness: CWE-295
Which versions are affected by CVE-2022-34394?
It affects 1 product.
Products include Dell Smartfabric Os10.
How do I fix CVE-2022-34394?
No fix has been published for CVE-2022-34394 yet. Limit exposure of the affected software until one is available.
Is CVE-2022-34394 being exploited?
There is no known exploitation of CVE-2022-34394 in the wild and no public exploit code.
Other vulnerabilities in Dell Networking OS10
- CVE-2023-32462 Command injection in Dell SmartFabric OS10
- CVE-2023-28078 Information disclosure in Dell SmartFabric OS10
- CVE-2025-46427 Command injection in SmartFabric OS10 Software
- CVE-2025-46428 Command injection in SmartFabric OS10 Software
- CVE-2024-48013 Privilege escalation in SmartFabric OS10 Software
Sources
Also known as GHSA-85wm-66pv-53vh.