CVE-2023-32464 Security feature bypass in Dell EMC VxRail Appliance
A high-privileged remote attacker can perform man-in-the-middle attacks to view or modify data in transit due to improper certificate validation.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-32464?
CVE-2023-32464 is a low-severity vulnerability in Dell EMC VxRail Appliance, published on 23 Jun 2023. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Dell VxRail, versions prior to 7.0.450, contain an improper certificate validation vulnerability. A high privileged remote attacker may potentially exploit this vulnerability to carry out a man-in-the-middle attack by supplying a crafted certificate and intercepting the victim's traffic to view or modify a victim’s data in transit.
Weakness: CWE-295
Which versions are affected by CVE-2023-32464?
It affects 45 products.
Products include Dell Vxrail D560 Firmware, Dell Vxrail D560f Firmware, Dell Vxrail E460 Firmware, Dell Vxrail E560 Firmware, Dell Vxrail E560 Vcf Firmware, Dell Vxrail E560f Firmware and 39 more.
How do I fix CVE-2023-32464?
No fix has been published for CVE-2023-32464 yet. Limit exposure of the affected software until one is available.
Is CVE-2023-32464 being exploited?
There is no known exploitation of CVE-2023-32464 in the wild and no public exploit code.
Other vulnerabilities in Dell EMC VxRail Appliance
Sources
Also known as GHSA-hq4r-9xhw-3x4h.