CVE-2023-32485 Privilege escalation in Dell SmartFabric Storage Software
A remote unauthenticated attacker can exploit improper input validation to escalate privileges to the highest administration level in Dell SmartFabric Storage Software.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-32485?
CVE-2023-32485 is a critical vulnerability in Dell SmartFabric Storage Software, published on 5 Oct 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Dell SmartFabric Storage Software version 1.3 and lower contain an improper input validation vulnerability. A remote unauthenticated attacker may exploit this vulnerability and escalate privileges up to the highest administration level. This is a critical severity vulnerability affecting user authentication. Dell recommends customers to upgrade at the earliest opportunity.
Weakness: CWE-20
Which versions are affected by CVE-2023-32485?
It affects 1 product.
Products include Dell Smartfabric Storage Software.
How do I fix CVE-2023-32485?
No fix has been published for CVE-2023-32485 yet. Limit exposure of the affected software until one is available.
Is CVE-2023-32485 being exploited?
There is no known exploitation of CVE-2023-32485 in the wild and no public exploit code.
Other vulnerabilities in Dell SmartFabric Storage Software
- CVE-2022-31232 Command injection in Smart Fabric Storage Software
- CVE-2023-43068 Command injection in Dell SmartFabric Storage Software
- CVE-2023-43069 Command injection in Dell SmartFabric Storage Software
- CVE-2023-4401 Command injection in Dell SmartFabric Storage Software
- CVE-2026-35070 Command injection in SmartFabric Storage Software
Sources
Also known as GHSA-92fc-m6h9-7rx3.