CVE-2023-39248 Denial of service in Dell Networking OS10
Remote unauthenticated attackers can cause network flooding and denial of service on Dell OS10 switches configured with VLT and VRRP.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-39248?
CVE-2023-39248 is a high-severity denial of service vulnerability in Dell Networking OS10, published on 5 Dec 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Dell OS10 Networking Switches running 10.5.2.x and above contain an Uncontrolled Resource Consumption (Denial of Service) vulnerability, when switches are configured with VLT and VRRP. A remote unauthenticated user can cause the network to be flooded leading to Denial of Service for actual network users. This is a high severity vulnerability as it allows an attacker to cause an outage of network. Dell recommends customers to upgrade at the earliest opportunity.
Weakness: CWE-400
Which versions are affected by CVE-2023-39248?
It affects 1 product.
Products include Dell Networking Os10.
How do I fix CVE-2023-39248?
No fix has been published for CVE-2023-39248 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2023-39248 being exploited?
There is no known exploitation of CVE-2023-39248 in the wild and no public exploit code.
Other vulnerabilities in Dell Networking OS10
- CVE-2024-25949 Privilege escalation in SmartFabric OS10 Software
- CVE-2021-36307 Privilege escalation in Networking OS
- CVE-2018-15778 DSA-2019-019: Dell Networking OS10 OS Command Injection Vulnerability
- CVE-2021-36306 Auth bypass in Networking OS
- CVE-2018-15784 DSA-2019-001: Dell Networking OS10 Improper Certificate Validation Vulnerability
Sources
Also known as GHSA-p2wr-4599-vv5h.